Microsoft has introduced the Hyperlight project, which develops a hypervisor intended for embedding in applications for the isolated execution of untrusted or specially protected code. The hypervisor is designed as a shared library that facilitates the execution of specific functions in lightweight virtual machines (micro-VMs) and organizes data exchange with these functions. The project code is written in Rust and is distributed under the Apache 2.0 license.
Compared to traditional launches, of virtual machines Hyperlight enables low latency and minimal overhead. In Hyperlight, the latency for creating virtual machines is 1-2 milliseconds, allowing function-level isolation. In contrast, launching a regular virtual machine takes at least 120 milliseconds, while the startup of an isolated sandbox environment for executing WebAssembly code using the Wasmtime runtime takes 0.03 milliseconds.
For isolation on the Linux platform, KVM and mshv (Microsoft Hypervisor in Azure Linux) hypervisors are supported, while on the Windows platform — WHP (Windows Hypervisor Platform) and WSL2 (Windows Subsystem for Linux 2) with KVM. The macOS platform is currently not supported. A separate kernel and operating system are virtual machine not used. The setup for the virtual machine is formed as a self-contained executable, including the code for the executed function wrapped in a runtime and a specialized minimal kernel. The virtual machine uses a single linear fragment of memory and allocates a virtual CPU, without device mapping and process separation.
The development process is based on linking the main application code with the Hyperlight Host library, which coordinates the launch of virtual machines, and the code for guest functions executed in isolation with the Hyperlight Guest library, which provides an API for interaction with the external part of the application and the capability for isolated code execution without an operating system environment.
The provided layer for interaction between the host application and isolated functions allows not only invoking isolated functions from host applications but also, conversely, accessing host application functions from isolated functions. The list of external functions allowed to be called from isolated functions is strictly regulated. By default, access from isolated functions is limited to a minimal API that permits messaging to the host application.
In the future, Microsoft plans to transfer the project to the non-profit organization Cloud Native Computing Foundation (CNCF) for collaborative development on a neutral platform that is not dependent on individual vendors. The CNCF organization operates under the Linux Foundation and oversees the development of such projects as Kubernetes, etcd, Cilium, Containerd, cri-o, Flux, Helm, Istio, and gRPC.
Source: opennet.ru
