Development, deployment and maintenance of networked software has been revolutionized by DevOps practices, which boost system software quality and agile evolution. However, as the Internet of Things (IoT) connects low-power, microcontroller-based devices which take part in larger distributed cyberphysical systems, such low-power IoT devices are not easy to integrate in DevOps workflows. In this paper, we contribute to mitigate this problem by designing Femto-Containers, a new hardware-independent mechanism which enable the virtualization and isolation of software modules embedded on microcontrollers, using an approach extending and adapting Berkeley Packet Filters (eBPF). We implement a Femto-Container hosting engine, which we integrate in a common low-power IoT operating system (RIOT), and is thus enhanced with the ability to start, update or terminate Femto-Containers on demand, securely over a standard IPv6/6LoWPAN network. We evaluate the performance of Femto-Containers in a variety of use cases. We show that Femto-Containers can virtualize and isolate multiple software modules executed concurrently, with very small memory footprint overhead (below 10%) and very small startup time (tens of microseconds) compared to native code execution. We carry out experiments deploying Femto-Containers on a testbed using heterogeneous IoT hardware based on the popular microcontroller architectures Arm Cortex-M, ESP32 and RISC-V. We show that compared to prior work on software-based low-power virtualization and isolation, Femto-Containers offer an attractive trade-off in terms of memory footprint, energy consumption, and security. The characteristics of Femto-Containers satisfy both the requirements of software modules hosting high-level logic coded in a variety of common programming languages, and the constraints of low-level debug snippets inserted on a hot code path.
翻译:DevOps软件的开发、部署和维护被DevOps软件的开发、部署和维护革命了。DevOps软件的开发、部署和维护已经革命了。但是,随着Things Internet(IoT)连接了低功率和微控制器的装置,这些装置参与了更大的分布式网络物理系统,这种低功率 IoT设备不容易融入DevOps的工作流程。在本文中,我们通过设计Femto- Containers的新硬件独立机制,使嵌入微控制器的软件模块的虚拟化和孤立化,采用扩大和修改伯克利包装过滤器的方法。我们实施了Femto- Container主机的低功率特性。我们实施了Femto-Contain主机的软化功能,我们将Femto Containal-developmental Indemodealal-deformal developmental Insteal 系统,我们用Semploy-deal-deal-deal-deal-demoal-demodemodeal-deal-deal-de-deal-deal-deal-deal-deal-deal demodemodeal demodeal demodeal demodeal demoal las,我们用了一个10 并同时运行运行了一个高级软模块,我们运行运行,我们用了一个高级软软软化的软化的内存储系统,我们使用标准,我们使用标准,我们调调调调调调调调调调调调调调调调调调调调调调制,我们调调调调调调调调调调调调调,我们调调调调调调调调制的内调调制,我们调,我们调调调调调调调调调调调调调调的内的内的内调低的内,我们调的内存储器,我们用的内存储器,我们用的内存储器,我们用的系统,我们用的内调,我们用的内调调调调制的内调制的内调的内调的内调制的内调的内调制的内调调调调制的内调调调制的内调调调调调制的内调调制的内