|
ZeroVM is an open source light-weight virtualization and sandboxing technology. It virtualizes a single process using the Google Native Client platform. Since only a single process is virtualized (instead of a full operating system), the startup overhead is in the order of 5 ms.〔 == Sandboxing == ZeroVM creates a sandbox around a single process, using technology based on Google Native Client (NaCl). The sandbox ensures that the application executed cannot access data in the host operating system, so it is safe to execute untrusted code. The programs executed in ZeroVM must first be cross-compiled to the NaCl platform. ZeroVM can only execute NaCl code compiled for the x86-64 platform, not the portable Native Client (PNaCl) format. Code executed in ZeroVM cannot call normal system calls and initially cannot interact with the host environment. All communication with the outside world takes place over ''channels'', which must be declared before the program starts. Outside the sandbox, a channel can be connected to a local file, to a pipe, or to another ZeroVM instance.〔(【引用サイトリンク】 url=https://github.com/zerovm/zerovm/blob/master/doc/channels.txt )〕 Inside the sandbox, the program sees the channel as a file descriptor. The sandboxed program can read/write data from/to the channel, but does not know where the channel is connected in the host. Programs compiled for ZeroVM can optionally use the ZeroVM Runtime library called ZRT. This library aims to provide the program with a POSIX environment.〔(【引用サイトリンク】 url=https://github.com/zerovm/zrt/blob/master/README.md )〕 It does this by replacing parts of the C standard library. In particular, ZRT replaces C file input/output functions such as fopen and opendir with versions that operate on an in-memory filesystem. The root filesystem is provided as a tarball. This allows a program to "see" a normal Unix environment.The ZRT also replaces C date and time functions such as time to give programs a fixed and ''deterministic'' environment. With fixed inputs, every execution is guaranteed to give the same result. Even non-functional programs become deterministic in this restricted environment.〔(【引用サイトリンク】 url=http://zerovm.org/architecture.htm )〕This makes programs easier to debug since their behavior is fixed. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「ZeroVM」の詳細全文を読む スポンサード リンク
|