all posts
blog · topic

Security, isolation and multi-tenancy

When the code in a sandbox is hostile, the isolation boundary is the product. These posts cover hardware versus kernel-level isolation, multi-tenant platform design, prompt injection and supply-chain attacks against agents, egress control, and the evidence auditors ask for.

PandaStack security

320 posts

·10 min read

Running a DICOM Pipeline in a MicroVM: Untrusted Medical Images, One Study at a Time

A DICOM file tells your process which several thousand lines of C to run next, and hospital archives are full of objects written by a decade of vendor encoders — so malformed is the normal case, not the attack case. Here is the per-study microVM shape that makes a crashing codec one deleted machine instead of a disclosure question.

dicommedical-imagingphi
Ajay Kumar
·11 min read

Per-Tenant Map Tile Rendering in MicroVMs: When Your Customers Write the Stylesheet

A map style is not configuration, it is a program: a few kilobytes of JSON that tells thirty years of C++ how much memory to allocate and which files to open. Here is what happens when one tenant writes a bad one, and the per-tenant microVM shape that keeps it their problem instead of everybody's.

map-tilesmulti-tenantmicrovm
Ajay Kumar
·11 min read

Per-Tenant Payroll and Tax Engines in microVMs: Determinism Is the Product

A payroll or tax engine is a pure function on paper and a function of fifteen undeclared arguments in production: tzdata, ICU, glibc, a rounding mode nobody chose, and the customer's own deduction formula. Then an amended return arrives three years later and asks for the same number, plus an explanation.

microvmfirecrackerpayroll
Ajay Kumar
·10 min read

A Font Is a Program: Rendering User-Uploaded Typefaces Without Trusting Them

The moment you accept a .ttf from a user, you have accepted a program: TrueType carries a stack machine, CFF carries another one, and woff2 puts a Brotli decoder in front of both. Here is why that parser should not run in the process holding your database credentials, and the microVM shape that fixes it.

font-renderingfreetypeharfbuzz
Ajay Kumar
·10 min read

Compiling a Stranger's Shader: Isolate the Toolchain, Because You Cannot Isolate a GPU You Do Not Have

If your product accepts shader source from users or from a model, you are running a pile of C++ parsers on hostile input. PandaStack has no GPU and cannot run your shader on one — but glslang, spirv-val, spirv-opt and spirv-cross are all CPU work, and that is the part that actually hurts you.

shader-compilationglslspir-v
Ajay Kumar
·10 min read

Analysing APKs Nobody on Your Team Wrote: One MicroVM Per Sample

The thing that breaks your mobile-app scanning pipeline is not a shell. It is a jadx run that pins every core on one crafted DEX, an apktool that writes small files until the volume runs out of inodes, and a zip entry named ../../etc/cron.d/x. Here is the isolation shape that survives that, and what it still cannot do.

mobile-securityapk-analysismicrovm
Ajay Kumar
·11 min read

PandaStack vs Kubernetes Jobs: Where "Just Create a Job" Stops Being the Right Answer

Your first instinct is to create a Kubernetes Job, and that instinct is usually correct. Here is the hardened Job you should actually write, the four mechanisms where the model breaks for untrusted per-request code, and the shim you will own if you push through anyway.

kuberneteskubernetes-jobsmulti-tenancy
Ajay Kumar
·10 min read

Firecracker vs Hyper-V Isolated Containers: Two Ecosystems, One Verdict

Microsoft shipped Hyper-V isolated containers because Windows containers on a shared kernel were not a boundary they would stand behind for other people's code. The Linux world shipped Firecracker, Kata and gVisor for exactly the same reason. Same verdict, opposite engineering — and one of them cannot run your Windows binary.

firecrackerhyper-vwindows-containers
Ajay Kumar
·11 min read

Every In-Process Python Sandbox Leaks, and the Reason Is Structural

Removing a name from a namespace removes a name, not reachability. CPython's object graph has no partitions, and `ctypes` is a documented feature whose purpose is calling arbitrary native code. Here is where the boundary actually has to go.

pythonsandboxingrestrictedpython
Ajay Kumar

More posts in this topic