• 강사 : 권영진 교수 (KAIST 전산학부)
• 일시 : 2023. 9. 18 (월) 16:00~17:30

In this talk, I would like to share my two experiences building two OSes for emerging cloud services.

Memory disaggregation has replaced the landscape of cloud systems by physically separating compute and memory nodes,
achieving improved utilization. As early efforts, kernel paging-based approaches offer transparent virtual memory abstraction
for remote memory with paging schemes but suffer from expensive page fault handling. We revisit the paging-based
approaches and challenges their performance in paging schemes. We posit that the overhead of the paging-based approaches
is not a fundamental limitation. We propose DiLOS, a new library operating system~(LibOS) specialized for paging-based memory
disaggregation. We have revamped the page fault handler to get away with the swap cache and incorporated known techniques
in our prefetcher, page manager, and communication module for performance optimization. Furthermore, we provide APIs to augment
the LibOS with application semantics.

OS containers have become a foundational component of cloud systems, offering benefits such as encapsulating the kernel, user libraries,
and applications to reduce operational costs and enhance manageability. While OS containers present the illusion of isolated kernel code
and states for processes, they share the same underlying kernel, raising concerns regarding security and fault isolation. Previous solutions
to address the isolation concerns are using virtual-machine-based systems, leveraging hardware-based isolation, but this approach often
introduces significant performance overhead. In response, we introduce a new approach, CofferOS, that leverages Rust’s safety features
to enhance container isolation. This paper introduces a Coffer abstraction, implemented as a class, which ensures that instances never
directly access the code and states of others. This isolation principle is achieved by encapsulating kernel code within each Coffer instance.
Cof ferOS, a new OS, containerizes kernels and processes within Coffer instances, strengthening security and fault isolation compared
to the traditional OS container.