UniFaaS: A Unikernel-Based Serverless Operating System

点击翻译按钮获取中文摘要

Serverless computing, also know as Function as a Service (FaaS), is an emergingprogramming paradigm providing significant benefits for both the tenant (i.e.the application developer) and the provider in terms of costs reduction,data centre efficiency, scalability, etc. With its truly on-demand resourceconsumption and pricing model, as well as the fact that the tenant is relievedfrom any infrastructure management effort, serverless has the potential offully delivering on the core promises of cloud computing, and experts agreethat its usage will skyrocket in the years to come.Serverless computing is made possible by two crucial concepts implemented bythe systems software assuring the execution of functions and running in theprovider's infrastructure: (1) the isolation of the data and performance ofmutually untrusting functions running on the same physical host and (2) thelightweightness of the systems software supporting the execution of functions,i.e. the potential for low memory and disk footprint as well as fast invocationtimes for this software. The current serverless infrastructures are suboptimalregarding both concepts as they use a combination of virtual machines (wellisolated but heavyweight) and containers (lightweight but presenting someserious isolation concerns).The unikernel is a new Operating System (OS) model in which an application isexecuted with a very small custom operating system layer as minimal virtualmachine in the cloud. In effect, unikernels combine the strong isolation ofvirtual machines with a container-like level of lightweightness. Thesecharacteristics make that the unikernel is a uniquely fit candidate to run asserverless infrastructure systems software.We propose to explore the use of the unikernel OS model as the primary unit offunction execution in a serverless computing infrastructure. We note thatalthough it presents some fundamental benefits, the unikernel model needs toevolve to perfectly fit the serverless domain. The principal issue is the lackof support for important features, namely intra-unikernel isolation andmulti-processing. These shortcomings are not simply due to missingimplementations, but rather derive from fundamental design principles of theunikernel OS model. Hence, we propose to design and implement UniFaaS as an evolution of theunikernel OS model tailored for serverless computing. UniFaaS aims to supportthe aforementioned lacking features, while maintaining the isolation andlightweightness benefits that unikernels naturally offer. UniFaaS will be builton top of an existing unikernel, namely OSv. The design and development effortwill be made along 3 main avenues: (1) new functionalities development, inparticular multi-process support using threads as well as furtherspecialisation the towards serverless computing; (2) security enhancements, inparticular the introduction of low-overhead intra-unikernel isolation usingmodern hardware technologies; and (3) lightweightness optimisations to furtherreduce per-unikernels and per-function memory/disk footprints as well asboot/invocation time through various methods, in order to increase per-hostfunction density.Once UniFaaS is built, we will evaluate its security/isolation,lightweightness, and performance, by comparing it to traditional serverlessdeployments that use virtual machines and containers. Regarding security, wenote that the current metrics to assess isolation (such as counting the numberof lines of code of a software) are rather imprecise and we will develop anovel method based on the amount of trusted code (guest kernel and/orhypervisor/host) that can be reached from an untrusted component (applicationcode, network, etc.).