Hardening WASM Serverless Edge Functions (6821)

Technical Overview

Engineering breakdown of Hardening WASM Serverless Edge Functions (6821). Bare-metal hardware performance requires isolated kernel parameters, capability-based sandboxing, and deterministic cold-start latency. We explore the Votion Cloud runtime's approach to WASM module verification, memory safety guarantees, and edge-specific threat models including side-channel mitigation and supply-chain integrity.

Threat Model & Attack Surface

Edge functions execute untrusted tenant code in multi-tenant environments. Primary vectors: malicious WASM modules exploiting host calls, timing attacks on shared caches, and resource exhaustion via unbounded recursion. Our hardening strategy layers: (1) WASM validation with custom LLVM passes, (2) seccomp-bpf syscall filtering per module, (3) Intel CET / ARM PAC for control-flow integrity, (4) deterministic fuel metering for CPU quotas.

Runtime Architecture

The Votion Edge Runtime (VER) runs on Firecracker microVMs with a custom KVM device model. Each function gets a dedicated WASM instance (Wasmtime + Cranelift) with a 4ms cold-start target. Network namespace isolation via CNI plugin, eBPF-based L7 observability, and mutual TLS termination at the edge proxy.