OS and System-software Laboratory (OSS Lab)

Container virtualization has become a dominant technology for deploying lightweight applications in cloud environments. However, because containers share the host OS kernel, they remain vulnerable to attacks that exploit kernel and network stack implementations. We propose Cross-OS Container Transplantation, which enhances security by running Linux binaries on FreeBSD via the Linuxulator emulation layer. By replacing Linux-specific kernel and network components with FreeBSD implementations, our method fundamentally mitigates implementation-dependent attacks. Additionally, we integrate the Capsicum framework for fine-grained sandboxing. Penetration testing demonstrates that our approach effectively thwarts attacks exploiting critical vulnerabilities. Performance evaluation indicates that our method achieves a significantly faster total container startup time than Kata Containers, while remaining comparable to native runC. With minimal runtime overhead, Cross-OS Container Transplantation provides a robust and lightweight defense against cross-layer exploits in containerized environments.

Checkpoint/restore (C/R) in the Edge-Cloud Continuum, where edge servers and cloud servers are integrated to combine their respective computational characteristics, enables application live migration for load balancing and service continuity that adapts to user mobility. WebAssembly (Wasm) provides architecture neutrality, allowing bytecode execution across diverse platforms. Furthermore, by leveraging runtime implementations specialized for particular environments and performance optimizations such as Just-In-Time (JIT) and Ahead-Of-Time (AOT) compilation, Wasm bytecode can be executed efficiently by using the runtime best suited to each environment. However, the diversity of runtimes and performance optimizations results in heterogeneous representations of application execution states, making it difficult to apply C/R across multiple runtimes. To address this heterogeneity, we propose a C/R method that employs a self-hosted Wasm runtime compiled into Wasm itself. By checkpointing and restoring application execution states within the self-hosted Wasm runtime, the representation of execution states can be unified. In addition, to mitigate the overhead of duplicated runtime executions, we also investigate optimization techniques for Wasm runtimes designed to be self-hosted. Our evaluation results demonstrate that C/R with a self-hosted Wasm runtime can eliminate runtime differences and enable efficient live migration with a minimal execution state.

Modern cloud-native systems increasingly rely on WebAssembly (Wasm) containers for their lightweight nature and fast startup times. However, ensuring high availability in the face of inevitable failures remains a critical challenge. Traditional selfhealing mechanisms, often based on simple container restarts, cause service disruption and performance degradation. This paper presents a novel approach to achieve seamless self-healing in Wasm container orchestration by leveraging a runtime-neutral checkpointing framework. This framework, developed in our prior work, captures an application’s complete execution state independent of any specific runtime implementation. Building on this foundation, we demonstrate how this capability enables two key functions: hot restart and dynamic runtime switching. Hot restart allows a failed container to be restored from a checkpoint in milliseconds, eliminating the overhead of a cold startup. More importantly, we introduce a new paradigm for memory pressure alleviation without Pod eviction. By utilizing our runtime-neutral checkpoints, the orchestration system can gracefully switch a running application from a high-performance runtime (e.g., WasmEdge) to a more memory-efficient one (e.g., WAMR) when resources are constrained. Our empirical evaluation confirms that this approach effectively alleviates memory pressure while causing only a minimal, short-lived performance impact, proving to be a superior alternative to disruptive evictionbased methods.

WebAssembly (Wasm) has been attracting attention as a common platform for edge computing thanks to its architecture neutrality, sandboxing for security, and lightweight characteristics that fit the requirements for distributed and cooperated processing with heterogeneous compute nodes, which consist of edge devices and clouds. Virtual machine (VM) migration technology enables seamless and flexible workload offloading on edge-cloud collaboration, but unfortunately, VM migration among different Wasm runtimes is complicated since the Wasm standardization does not specify the implementation design of internal runtime very well. Nevertheless, many implementations of Wasm runtime already exist, and each has different characteristics. We therefore aim to implement a stateful VM migration among most of the major Wasm runtimes. In this work, we prototyped a VM migration mechanism between WasmEdge and WAMR to investigate the technical challenges and determine the feasibility of implementing the runtime-neutral VM migration. Our experimental results on heterogenous VM migration demonstrate the value of coexisting multiple runtimes well-suited for each edge and cloud and seamlessly offloading the workloads among them.

Containers, which have evolved in Linux primarily, have become a significant trend in the cloud due to their lightweight virtualization and growing convenient ecosystem. However, the laxer isolation of containerization also introduces attack surfaces on the underlying Linux kernel. Unfortunately, combining other virtualizations, such as the traditional VM and interposition by application kernel, for sandboxing could spoil the lightweight and scalable nature of the containers. In this study, we propose another approach to lightweight sandboxing that focuses on the fact that such attackers have mostly assumed containers rely on Linux. It can avert major vulnerability exploits derived from Linux by transplanting Linux containers onto the FreeBSD kernel. Furthermore, it can fortify the isolation by transparently applying "Capsicum," a unique sandbox mechanism that is nonstandard in Linux, to the transplanted containers. This paper analyzes vulnerabilities faced by Linux containers, identifies technical issues in transplanting Linux containers onto FreeBSD, and designs a mechanism to transparently apply the Capsicum sandbox to Linux applications to explore the feasibility of our approach.