Software containerization technologies for resource-limited devices enable multi-tenant microcontrollers, which allow running multiple applications with different permission levels. However, current solutions lack run time configuration over various settings on container scheduling and container permissions to host resources. This limits the applicability of constrained containerization in dynamic and heterogeneous environments. This paper introduces TinyContainer, a lightweight software container management middleware designed for multi-tenant microcontrollers. TinyContainer provides per-container configurable scheduling and fine-grained access control to host resources through a metadata-driven approach, supporting multiple runtimes via a runtime abstraction layer. We analyze the performance of TinyContainer with a small WebAssembly runtime, CS4WAMR, and RIOT OS, a common RTOS. We report on experiments using popular IoT boards based on various Cortex-M microcontrollers. We show the endpoint system brought by TinyContainer allowing to regulate access of containers to host resources and provide host services to containers with an overhead of up to 4 ms per call. In particular, we showcase a TinyML use case, whereby containers retain data and model weights, while model inference is delegated to native host RTOS services.

翻译：针对资源受限设备的软件容器化技术使多租户微控制器成为可能，允许运行具有不同权限级别的多个应用程序。然而，当前解决方案缺乏对容器调度及容器对宿主机资源访问权限等各类设置的运行时配置能力，这限制了受限容器化技术在动态异构环境中的适用性。本文介绍TinyContainer——一种专为多租户微控制器设计的轻量级软件容器管理中间件。TinyContainer通过元数据驱动方法提供每容器的可配置调度机制及细粒度的宿主机资源访问控制，并借助运行时抽象层支持多种运行时环境。我们基于小型WebAssembly运行时CS4WAMR与通用RTOS RIOT OS分析了TinyContainer的性能，并报告了基于多种Cortex-M微控制器的主流物联网板卡实验数据。实验表明，TinyContainer引入的端点系统可规范容器对宿主机资源的访问，并为容器提供宿主机服务，每次调用开销最高仅4毫秒。特别地，我们展示了一个TinyML用例：容器保留数据与模型权重，而模型推理任务则委托给原生宿主机RTOS服务执行。