Search Results for "attack surface management"

LiteBox is a security-focused “library OS” sandboxing project that aims to shrink the interface between an application and its host environment to reduce attack surface. Instead of relying solely on broad OS-level permissions, it focuses on isolating workloads by tightly controlling the boundary where code interacts with host services and system resources. The design emphasizes interoperability across different integration layers, describing a separation between “North” shims (how apps or runtimes plug in) and “South” platforms (where the sandbox runs), which helps the system adapt to multiple deployment contexts. ...

Firecracker is an open-source virtualization technology developed by AWS for deploying secure micro-VMs (microVMs) that offer strong isolation with minimal overhead. Designed for serverless workloads (e.g., AWS Lambda, Fargate), it combines VM-level security with container-like performance and startup speed.

Hermit-RS is a Rust-based unikernel designed for high-performance and cloud computing applications. By combining the safety and concurrency features of Rust with the minimalistic approach of unikernels, Hermit-RS offers a secure and efficient runtime environment. It is particularly suited for running single-tenant applications directly on hypervisors or bare-metal hardware, reducing overhead and improving performance.

...Unlike general-purpose emulators like QEMU, crosvm avoids full hardware emulation and focuses on modern paravirtualized I/O using the virtio standard, reducing complexity and attack surface. Written in Rust, it emphasizes memory safety and modularity, allowing sandboxed device emulation with fine-grained privilege separation. crosvm underpins several ChromeOS subsystems, including Android Runtime for Chrome (ARCVM) and Crostini Linux containers, enabling rich application compatibility within a tightly controlled environment.