Sandboxing Wasm Programs - Syscall Isolation Techniques for Edge Computing
Explore the critical aspects of sandboxing WebAssembly (Wasm) programs in this 26-minute conference talk by Ryan Petrich from Two Sigma Investments. Delve into the challenges of safely running multi-tenant code on shared hardware for edge computing platforms. Examine how major Wasm runtimes construct their sandboxes and confine running programs, while understanding potential vulnerabilities such as side channels, configuration errors, and runtime bugs. Discover additional sandboxing techniques including SELinux, cgroups, and seccomp. Learn about Callander, a novel syscall sandboxing tool designed to impede shellcode execution. Gain insights into enhancing the Wasm ecosystem's security approach with monitoring, bubble wrap, and protective measures to ensure robust isolation and safeguard against malicious activities.