Function-as-a-Service (FaaS) is a promising edge computing execution model but requires secure sandboxing mechanisms to isolate workloads from multiple tenants on constrained infrastructure. Although Docker containers are lightweight and popular in open-source FaaS platforms, they are generally considered insufficient for executing untrusted code and providing sandbox isolation. Commercial cloud FaaS platforms thus rely on Linux microVMs or hardened container runtimes, which are secure but come with a higher resource footprint. Unikernels combine application code and limited operating system primitives into a single purpose appliance, reducing the footprint of an application and its sandbox while providing full Linux compatibility. In this paper, we study the suitability of unikernels as an edge FaaS execution environment using the Nanos and OSv unikernel tool chains. We compare performance along several metrics such as cold start overhead and idle footprint against sandboxes such as Firecracker Linux microVMs, Docker containers, and secure gVisor containers. We find that unikernels exhibit desirable cold start performance, yet lag behind Linux microVMs in stability. Nevertheless, we show that unikernels are a promising candidate for further research on Linux-compatible FaaS isolation.

翻译：函数即服务（FaaS）是边缘计算中一种有前景的执行模型，但需要在受限基础设施上为多租户工作负载提供安全沙箱隔离机制。尽管Docker容器在开源FaaS平台中轻量且广受欢迎，但通常被认为不足以执行不可信代码及提供沙箱隔离。因此，商业云FaaS平台依赖于Linux微虚拟机或加固容器运行时，这些方案虽安全但资源占用更高。Unikernels将应用程序代码与有限操作系统原语整合为单一专用设备，在降低应用及沙箱资源占用的同时，提供完全的Linux兼容性。本文利用Nanos和OSv unikernel工具链，研究unikernels作为边缘FaaS执行环境的适用性。我们针对冷启动开销、空闲资源占用等指标，将其与Firecracker Linux微虚拟机、Docker容器及安全gVisor容器等沙箱方案进行对比。实验发现，unikernels在冷启动性能方面表现优异，但稳定性仍落后于Linux微虚拟机。尽管如此，我们证明unikernels是进一步研究兼容Linux的FaaS隔离机制的有前景候选方案。