Varnish Software, a company developing systems for building content delivery and caching networks, has introduced an open project called TinyKVM, which enhances the tools for isolating the execution of individual processes using the KVM hypervisor. The project's goal is to create the fastest sandbox isolation system for individual processes that utilizes hardware virtualization. The project's code is written in C and C++, and is distributed under the GPLv3 license (a commercial license is available for those unwilling to comply with GPLv3 requirements).
TinyKVM is designed for the isolated execution of any console programs for Linux with performance close to standard execution. The overhead for each system call is approximately 2 microseconds. An example of the project's application is additional process isolation within caching and web request processing systems. TinyKVM is intended to replace the libriscv emulator used for isolating the processing of each web request in the Varnish platform. Additionally, a version of the libvmod library has been created to allow modules for Varnish to be run using TinyKVM.
When launched using TinyKVM, the machine code of programs runs without emulation layers on the CPU and is constrained through the KVM hypervisor API, which eliminates overhead and achieves performance close to that of running without virtualization. The main features of TinyKVM include:
- Limiting maximum execution time. The program can be forcibly stopped after the timeout elapses, without invoking signal handlers and threads.
- Limiting memory consumption.
- The ability to fork uninitalized instances of virtual machines from one initialized instance of an isolated program. Copies of virtual machines are created in copy-on-write mode, allowing for significant memory savings by storing only one instance of shared data.
- Forked processes can revert to a previous state (for example, a forked HTTP request handler can return to its original state after processing each request without needing a restart). An instance of an isolated process can also be reset to the state of another virtual machine, not necessarily the one from which it was forked, but the overhead will be higher since it will require changes to the memory page table.
- Support for creating static memory pages during initialization, even suitable for complex runtimes, such as in the Go language. In this case, modifications are only allowed for pages in copy-on-write mode.
- Support for remote debugging using GDB. On-the-fly debugging is possible with execution resuming.
The TinyKVM guest environment forms a trimmed-down kernel, protected from modifications, built with memory page protection enabled and utilizing SMAP (Supervisor Mode Access Prevention) and SMEP (Supervisor Mode Execution Prevention) for additional isolation between the kernel and user space. TinyKVM uses large memory pages (hugepages) to enhance performance. System calls invoked by programs are intercepted by the emulator and redirected into the host environment (the processing and translation delay of the emulated call is about 2 microseconds). Within the virtual machine no drivers, I/O, or virtual devices are used.
Source: opennet.ru
