Resource elasticity is one of the key defining characteristics of the Function-as-a-Service (FaaS) serverless computing paradigm. While compute resources assigned to VM-sandboxed functions can be seamlessly adjusted on the fly, memory elasticity remains challenging. Hot(un)plugging memory resources suffers from long reclamation latencies and occupies valuable CPU resources. We identify the obliviousness of the OS memory manager to the hotplugged memory as the key issue hindering hot-unplug performance, and design Squeezy, a novel approach for fast and efficient VM memory hot(un)plug, targeting VM-sandboxed serverless functions. Our key insight is that by segregating hotplugged memory regions from regular VM memory, we are able to bound the lifetime of allocations within these regions thus enabling their fast and efficient reclamation. We implement Squeezy in Linux v6.6 as an extension to the OS memory manager. Our evaluation reveals that Squeezy is an order-of-magnitude faster than state-of-the-art, keeping tail latency bounded, when reclaiming VM memory, achieving sub-second reclamation of multiple GiBs of memory while serving realistic FaaS load.

In this work, we design SnapBPF, an eBPF-based snapshot prefetching mechanism, targeting VM-sandboxed serverless functions, which enables the efficient capture and prefetching of function working sets in kernel-space. SnapBPF deduplicates function working sets in memory and obviates the need for separately serializing them on disk. We complement SnapBPF with a lightweight paravirtualized interface to efficiently handle VM-sandbox memory allocations without requiring any snapshot pre-processing. Our evaluation shows that SnapBPF is able to match and improve state-of-the-art performance with regard to i) function invocation latency and ii) memory usage for concurrent function invocations, without separately serializing working sets on disk or requiring any preemptive snapshot scanning.

The Cloud Native paradigm has quickly emerged as a new trend in Web Services architectures. Applications are now developed as a network of microservices and functions that can be quickly re-deployed anywhere, decoupled from their state. In this scenario, workloads are usually packaged as container images that can be quickly provisioned anywhere in a provider web service. To enforce security, traditional Docker container runtime mechanisms are now being enhanced by stronger isolation techniques such as lightweight hardware level virtualization. Such sandboxing inserts a strong boundary - the guest space - and therefore security containers do not share filesystem semantics with the host Operating System. However, the existing container storage drivers are designed and optimized to run directly on the host. In this paper we bridge the gap between traditional containers and virtualized containers. We present Deverlay, a container storage driver that prepares a block-based container root filesystem view, targeting lightweight Virtual Machines and keeping host native execution compatibility. We show that, in contrast to other block-based drivers, Deverlay can boot 80 micro VM containers in less than 4s by efficiently sharing host cache buffers among containers and reducing I/O disk access by 97.51 %.