System Architecture and Security
Containing Untrusted Workloads Through OS-Level Isolation
Research ID: workload-isolation
Isolate applications and services with different trust levels, restrict access to sensitive resources and limit the consequences of a compromised workload.
Problem statement
Investigate how Black Wall can isolate applications and services with different trust levels, restrict access to sensitive resources, and limit the consequences of compromised workloads.
Why it matters
Applications routinely run with more access than their function requires. Trust-level boundaries and explicit resource permissions reduce the blast radius when one workload is compromised.
Research questions
- 01 What trust levels are meaningful, and how is a workload assigned to one?
- 02 How should capability-based permissions and sandboxing be expressed and enforced?
- 03 Which filesystem, device and network access can be denied without breaking the workload?
- 04 What CPU and memory limits are needed to contain abuse while preserving service quality?
Research objectives
- Define application trust levels.
- Evaluate capability-based permissions and sandboxing.
- Restrict filesystem, device, and network access.
- Establish CPU and memory resource limits.
- Test isolation boundaries under simulated compromise.
Technical challenges
- Real applications depend on implicit access that has to be discovered before it can be removed.
- Sandboxing and capability checks add latency to system-call and I/O paths.
- Resource limits can turn a compromised workload into a local denial-of-service.
- Isolation tests must be adversarial rather than limited to expected failure modes.
Expected outcome
A prototype workload-isolation framework with a threat model and performance measurements.
Tags
Related research
Work on this problem
Apply to the lab and this problem becomes your supervised research project.