Controlling Opaque-Component Effects with Semisolates and Try
Talkat 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26) · 2026-07-13..07-15·
summary
Introduces semisolates and the unprivileged command try that capture, inspect, stack, and selectively apply filesystem effects from opaque components while running in the real environment. Implementation uses Linux namespaces, an overlay/union filesystem, and syscall tracing with no kernel changes. Evaluated on five use cases with 25 experiments, preserves behavioral equivalence, outperforms Docker in these scenarios, and incurs modest overheads; deployed in research and production and awarded Best Paper and Distinguished Artifact.
AI-written summary · about
chapters (10)
- 0:00Effect control challenges
- 1:02Risks of opaque component effects
- 2:25Containers and VMs limits
- 3:50Semi-isolate abstraction
- 5:14Try implements semi-isolates
- 7:18Evaluating Try's effects
- 8:21Try vs Docker performance
- 9:27Live demo of Try
- 11:09Downstream uses of Try
- 11:51Q&A
related talks
26mAn Effective Approach to Software Obfuscation
29mA new tool for fighting against Hyrum’s law in ... concept-driven design
36mPardon the Interposition—Modifying and Improving Software Behavior with Interposers
01mTalk Preview - The Surprising Power of Small Wrapper Classes in C++
21mTestable Architecture: Keep 'em Separated
24mContaining Agent Chaos
59mDecomposing Java applications
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs