Open Source Summit + ELC Europe 2018

As computing platforms evolve and OS paradigms shift to cloud computing, VMs are no longer sufficient for offering application compatibility or scalable sandboxing. Containers, on the other hand, are not portable and weakly isolated. A library OS offers compatibility and isolation like a VM, and is lightweight like a container. This talk will introduce Graphene, a Linux library OS designed for compatibility and sandboxing, on platforms where even virtualization is infeasible. For instance, Intel SGX, a rising trusted execution platform, has strict compatibility and resource constraints. Graphene re-implements a major portion of the Linux system calls as a library, using a small, generic host interface ported for SGX and other platforms. This talk will share the experience of implementing Linux from scratch, and how Graphene with SGX serves as a confidential computing platform for unmodified Linux applications.