Denali: Lightweight Virtual Machines for Distributed and Networked Applications

The goal of Denali is to safely execute many inde-pendent, untrusted server applications on a single phys-ical machine. This would enable any developer to inject a new service into third-party Internet infrastructure; for example, dynamic content generation code could be introduced into content-delivery networks or caching systems. We believe that virtual machine monitors (VMMs) are ideally suited to this application domain. A VMM provides strong isolation by default, since one virtual machine cannot directly name a resource in an-other. In addition, VMMs defer the implementation of high-level abstractions to guest OSs, which greatly sim-pli¯es the kernel and avoids \layer-below " attacks. The main challenge in using a VMM for this application do-main is in scaling the number of concurrent virtual ma-chines that can simultaneously execute on it. The distinction between Denali and existing VMMs is that we make aggressive use of para-virtualization tech-niques. Para-virtualization entails selectively modifying the virtual architecture to enhance scalability, perfor-mance, and simplicity. By using para-virtualization, we believe Denali will be able to scale up to an order-of-magnitude more virtual machines than existing VMMs. We have implemented a prototype virtual machine mon-itor that runs in ring 0 on bare x86 hardware. In addi-tion, we have built a simple guest OS tailored to writing Internet services.