CloudCAP: Compartments and cloud-native applications

CHERI object-capability compartments is a new isolation technology provided by Arm CHERI hardware. Compartments reside in a program address-space and enable isolated execution of mutually-distrusted parts of the program: data and code of a compartment can be accessed only by the data and code. Taking into account the growing number of Arm-based servers, one can think about a cloud system where CHERI object-capability compartments become a new building block for lightweight isolation abstractions. In this project, we try to reconsider the whole cloud stack and incorporate the compartments into it. We seek answers to the questions:
-- Can compartments replace hardware and name-space virtualisation technologies?
-- How can cloud-native applications benefit from the introduction of hardware capabilities (including the fat pointers and object-capability compartments)?
-- What kind of new cloud applications can be developed with the new compartmentalisation technology?
UK Research and Innovation (UKRI)

Related Publications

Vasily A. Sartakov, Lluís Vilanova, and Peter Pietzuch
International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), 2021
Vasily A. Sartakov, Daniel O'Keeffe, David Eyers, Lluís Vilanova, and Peter Pietzuch
the 17th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE ’21), 2021