Search Results for "attack surface management"

...Unlike general-purpose emulators like QEMU, crosvm avoids full hardware emulation and focuses on modern paravirtualized I/O using the virtio standard, reducing complexity and attack surface. Written in Rust, it emphasizes memory safety and modularity, allowing sandboxed device emulation with fine-grained privilege separation. crosvm underpins several ChromeOS subsystems, including Android Runtime for Chrome (ARCVM) and Crostini Linux containers, enabling rich application compatibility within a tightly controlled environment.

HaLVM is a Haskell-based unikernel system that lets you write entire virtual machines in Haskell and run them directly on a hypervisor, traditionally Xen. Instead of deploying a full operating system, you compile a Haskell program into a tiny image that boots as its own VM, which reduces the attack surface and startup time. The project adapts GHC and the Haskell runtime to a minimal environment, providing the I/O, networking, and memory facilities necessary for standalone services. Its design encourages highly isolated services—each VM does one job—making it attractive for security-sensitive components and research on microservice-style architectures. ...