dvm

Time-travelling sandbox.

Start sandboxing

django-14011seed 7illustrative

  5. main drops the test database; request still holds a connection to it.

Secure by design.

dvm runs your Docker images unmodified, on a secure kernel-hypervisor co-design sandbox.

Virtual machines gen 1

programs
guest Linux
hypervisor
programs
guest Linux
hypervisor
Linux

1999–2013

A whole Linux on a heavy hypervisor, for every sandbox.

Containers gen 2

Docker image
Docker image
Docker
Linux, shared

2013–2018

Docker images on one Linux kernel, shared by every sandbox.

MicroVMs gen 3

Docker image
guest Linux
Firecracker
Docker image
guest Linux
Firecracker
Linux

2018–2026

Each Docker image on its own Linux, on a VMM built apart from it.

dvm gen 4

Docker image
dvm
Docker image
dvm
Linux

2026–

Each Docker image on dvm, a kernel and hypervisor written together, from scratch.

Run once, replay everywhere.

Replay a run later, on another machine, and it is the same run.

runseed 7

replayright awaysame run

replayanother machinesame run

replaylatersame run

Rewind to every instruction.

Stop a run at any instruction, and read every thread’s stack and any address in its memory.

main
request
holds a connection

Thread main

  1. #0_create_test_dbdjango/db/backends/base/creation.py
  2. #1create_test_dbdjango/db/backends/base/creation.py
  3. #2setup_databasesdjango/test/utils.py
  4. #3run_testsdjango/test/runner.py
  5. #4django_teststests/runtests.py
  1. #0run_checksdjango/core/checks/registry.py
  2. #1run_checksdjango/test/runner.py
  3. #2run_testsdjango/test/runner.py
  4. #3django_teststests/runtests.py
  1. #0readintosocket.py
  2. #1beginhttp/client.py
  3. #2urlopenurllib/request.py
  4. #3test_viewtests/servers/tests.py
  5. #4run_suitedjango/test/runner.py
  6. #5run_testsdjango/test/runner.py
  7. #6django_teststests/runtests.py
  1. #0rununittest/runner.py
  2. #1run_suitedjango/test/runner.py
  3. #2run_testsdjango/test/runner.py
  4. #3django_teststests/runtests.py
  1. #0executedjango/db/backends/utils.pyDROP DATABASE "test_django"
  2. #1_destroy_test_dbdjango/db/backends/base/creation.py
  3. #2destroy_test_dbdjango/db/backends/base/creation.py
  4. #3teardown_databasesdjango/test/utils.py
  5. #4run_testsdjango/test/runner.py
  6. #5django_teststests/runtests.py
  1. #0executedjango/db/backends/utils.pyDROP DATABASE "test_django"
  2. #1_destroy_test_dbdjango/db/backends/base/creation.py
  3. #2destroy_test_dbdjango/db/backends/base/creation.py
  4. #3teardown_databasesdjango/test/utils.py
  5. #4run_testsdjango/test/runner.py
  6. #5django_teststests/runtests.py
  1. #0executedjango/db/backends/utils.pyDROP DATABASE "test_django"
  2. #1_destroy_test_dbdjango/db/backends/base/creation.py
  3. #2destroy_test_dbdjango/db/backends/base/creation.py
  4. #3teardown_databasesdjango/test/utils.py
  5. #4run_testsdjango/test/runner.py
  6. #5django_teststests/runtests.py

exited

Thread request

not started

not started

holds a database connection

  1. #0log_messagedjango/core/servers/basehttp.py
  2. #1handle_one_requestdjango/core/servers/basehttp.py
  3. #2handledjango/core/servers/basehttp.py
  4. #3finish_requestsocketserver.py
  5. #4process_request_threadsocketserver.py
  6. #5runthreading.py

holds a database connection

  1. #0readintosocket.pywaits for the next request
  2. #1handle_one_requestdjango/core/servers/basehttp.py
  3. #2handledjango/core/servers/basehttp.py
  4. #3finish_requestsocketserver.py
  5. #4process_request_threadsocketserver.py
  6. #5runthreading.py

holds a database connection

  1. #0readintosocket.pywaits for the next request
  2. #1handle_one_requestdjango/core/servers/basehttp.py
  3. #2handledjango/core/servers/basehttp.py
  4. #3finish_requestsocketserver.py
  5. #4process_request_threadsocketserver.py
  6. #5runthreading.py
  1. #0shutdown_requestsocketserver.py
  2. #1process_request_threadsocketserver.py
  3. #2runthreading.py

exited

exited

0x7f3c2a40e010main’s send buffer

0x7f3c2a40e010+0051000000224352454154452044415441Q..."CREATE DATA
0x7f3c2a40e020+10424153452022746573745f646a616e67BASE "test_djang
0x7f3c2a40e030+206f220000000000000000000000000000o"..............
0x7f3c2a40e010+0051000000224352454154452044415441Q..."CREATE DATA
0x7f3c2a40e020+10424153452022746573745f646a616e67BASE "test_djang
0x7f3c2a40e030+206f220000000000000000000000000000o"..............
0x7f3c2a40e010+0051000000224352454154452044415441Q..."CREATE DATA
0x7f3c2a40e020+10424153452022746573745f646a616e67BASE "test_djang
0x7f3c2a40e030+206f220000000000000000000000000000o"..............
0x7f3c2a40e010+0051000000224352454154452044415441Q..."CREATE DATA
0x7f3c2a40e020+10424153452022746573745f646a616e67BASE "test_djang
0x7f3c2a40e030+206f220000000000000000000000000000o"..............
0x7f3c2a40e010+00510000002044524f5020444154414241Q... DROP DATABA
0x7f3c2a40e020+1053452022746573745f646a616e676f22SE "test_django"
0x7f3c2a40e030+2000000000000000000000000000000000................
0x7f3c2a40e010+00510000002044524f5020444154414241Q... DROP DATABA
0x7f3c2a40e020+1053452022746573745f646a616e676f22SE "test_django"
0x7f3c2a40e030+2000000000000000000000000000000000................
0x7f3c2a40e010+00510000002044524f5020444154414241Q... DROP DATABA
0x7f3c2a40e020+1053452022746573745f646a616e676f22SE "test_django"
0x7f3c2a40e030+2000000000000000000000000000000000................
0x7f3c2a40e010+00510000002044524f5020444154414241Q... DROP DATABA
0x7f3c2a40e020+1053452022746573745f646a616e676f22SE "test_django"
0x7f3c2a40e030+2000000000000000000000000000000000................

0x7f3c2a412020main’s receive buffer

0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+0043000000144352454154452044415441C....CREATE DATA
0x7f3c2a412030+1042415345005a00000005490000000000BASE.Z....I.....
0x7f3c2a412040+2000000000000000000000000000000000................
0x7f3c2a412020+00450000004c534552524f520043353530E...LSERROR.C550
0x7f3c2a412030+103036004d64617461626173652022746506.Mdatabase "te
0x7f3c2a412040+2073745f646a616e676f22206973206265st_django" is be
0x7f3c2a412020+00450000004c534552524f520043353530E...LSERROR.C550
0x7f3c2a412030+103036004d64617461626173652022746506.Mdatabase "te
0x7f3c2a412040+2073745f646a616e676f22206973206265st_django" is be

Observability reimagined.

dvm logs 1000× less data, yet reproduces every instruction, memory value, and packet.

dvm shows20 nsof the run’s 400 ms

tracing1.3 MB/s
dvm0.9 KB/s

Audit everything.

dvm audits every external event, and blocks every unauthorized interaction.

from one run12,480 requests

hostspypi.org, api.github.com

−1,906

IP ranges10.0.0.0/8

−812

files/workspace/**

−1,240

hours09:00–18:00 UTC

−433

requestsat most 500 a minute

−1,127

6,962 allowed5,518 blocked

Rewind your first run.

Start sandboxing