CloudCAP: Compartments and cloud-native applications
CHERI object-capability compartments is a new isolation technology provided by Arm CHERI hardware. Compartments reside in a program address-space and enable isolated execution of mutually-distrusted parts of the program: data and code of a compartment can be accessed only by the data and code. Taking into account the growing number of Arm-based servers, one can think about a cloud system where CHERI object-capability compartments become a new building block for lightweight isolation abstractions.
In this project, we try to reconsider the whole cloud stack and incorporate the compartments into it. We seek answers to the questions:
-- Can compartments replace hardware and name-space virtualisation technologies?
-- How can cloud-native applications benefit from the introduction of hardware capabilities (including the fat pointers and object-capability compartments)?
-- What kind of new cloud applications can be developed with the new compartmentalisation technology?