Sandboxing Functions for Efficient and Secure Multi-tenant Serverless Deployments

Charalampos Mainas, Ioannis Plakas, Georgios Ntoutsos, Anastassios Nanos

SESAME @ EuroSys (2nd Workshop on Serverless Systems, Applications and Methodologies)

2024
urunc

Abstract

Serverless computing streamlines development and resource use, but ensuring performance and isolation for workloads in multi-tenant environments remains a critical challenge. The authors identify the need for sandboxing mechanisms to extend Knative's tenancy model, noting that existing isolation solutions like gVisor and Kata Containers do not meet the requirements for running untrusted workloads in a Knative cluster. They build an end-to-end unikernel-based serverless system and compare it to existing sandboxes, finding that current mechanisms incur significant overhead while the unikernel-based solution strikes a compelling balance of performance and security, matching the response times of generic containers.

Resources

PDF DOI

BibTeX

@inproceedings{mainas2024sandboxing,
  title={Sandboxing Functions for Efficient and Secure Multi-tenant Serverless Deployments},
  author={Charalampos Mainas and Ioannis Plakas and Georgios Ntoutsos and Anastassios Nanos},
  booktitle={SESAME @ EuroSys (2nd Workshop on Serverless Systems, Applications and Methodologies)},
  year={2024},
  pages={25-31},
  doi={10.1145/3642977.3652096}
}
← Back