all posts
blog · topic

Security, isolation and multi-tenancy

When the code in a sandbox is hostile, the isolation boundary is the product. These posts cover hardware versus kernel-level isolation, multi-tenant platform design, prompt injection and supply-chain attacks against agents, egress control, and the evidence auditors ask for.

PandaStack security

285 posts

·12 min read

What FedRAMP Asks of a Platform That Runs Untrusted Code

An ephemeral-by-design fleet is hostile to a control set that assumes a stable, enumerable inventory — and a snapshot memory image is an asset class nobody wrote a control for.

fedrampcompliancenist-800-53
Ajay Kumar
·11 min read

Private npm and PyPI Mirrors in Front of a Sandbox Fleet

A container fleet warms up. An ephemeral sandbox fleet cannot, because the whole point is that guest number four thousand is byte-identical to guest number one. That property is worth having and it means you will download left-pad four thousand times unless you do something about it.

npmpypiregistry
Ajay Kumar
·11 min read

Answering a Security Questionnaire When You Run Customer Code

The spreadsheet was written for a CRM. You run code a customer's model wrote ninety seconds ago. About a dozen rows carry the entire review, and the most important one is not on the sheet at all.

securitycomplianceenterprise
Ajay Kumar
·10 min read

Multi-Tenant WordPress Hosting on Firecracker MicroVMs

WordPress is a plugin-execution engine wearing a CMS costume, which makes shared hosting a multi-tenant remote code execution service with good branding. A look at why the PHP hardening stack is not a boundary, and what changes when every site gets its own kernel.

wordpressphpmulti-tenant
Ajay Kumar
·11 min read

Giving a MicroVM Access to a Customer's Private Network

The customer's database is in their VPC and your sandbox is not. The naive answer is to hand them your egress IPs and ask them to open a hole; the answer that survives a security review is a WireGuard peer per sandbox, minted after restore, revoked on teardown, and never, ever baked into a snapshot.

networkingsecuritywireguard
Ajay Kumar
·10 min read

Running EDA and Chip-Design Workloads in MicroVMs

In most workloads the compute is worth more than the data. In chip design it is emphatically the other way round: a netlist or a foundry PDK leaking to a co-tenant is a company-ending event, and the NDA you signed has opinions about which kernel your job shares.

edachip-designmicrovm
Ajay Kumar
·11 min read

CircleCI Self-Hosted Runners on MicroVMs

The moment you move a CircleCI job onto your own machine runner, you quietly trade a fresh VM per job for a box that remembers every build that ever ran on it. That trade is the whole security story, and you do not have to make it.

circlecici-cdmicrovm
Ajay Kumar
·10 min read

Rowhammer and the Attacks Below Your Hypervisor

Every isolation guarantee you buy is enforced by software running on hardware that several tenants share. Rowhammer is the clearest example of what that sentence costs: a bit flip in a DRAM row you do not own, achieved by physics rather than by a bug. Here's the honest version — what it takes to land, what ECC and TRR really buy, and the two mitigations that actually change the answer.

securityisolationhardware
Ajay Kumar
·12 min read

Knowing Which Customer Costs You Money

If you run code on behalf of customers, your cloud bill arrives as one number and your customers arrive as a list. Splitting the first across the second is a real engineering problem, and nearly everyone gets it wrong the same way: by attributing on wall-clock vCPU, which overcharges the bursty and undercharges the idle.

cost-attributionbillingmetering
Ajay Kumar

More posts in this topic