Evaluate OS-Level Containment for a Multi-Tenant Edge Platform
Overview
What this challenge is about.
Set up reproducible environments for gVisor, Firecracker, and Wasmtime on identical hardware (4 vCPU, 8 GB RAM). Run the platform's 4 workload archetypes (anonymized): API proxy, image-resize, ML inference (small), short-lived batch. Measure cold-start latency (p50, p99), steady-state CPU + memory under sustained load, and tenant-density-per-host. Document the security blast radius per technology (what a sandbox escape would expose). Deliver Terraform / docker setup, a benchmark Jupyter notebook, and a 7-page memo recommending one (or a hybrid) with workload-to-runtime mapping.
The Brief
What you'll do, and what you'll demonstrate.
Benchmark gVisor, Firecracker, and Wasmtime across 4 workload archetypes and recommend a containment strategy for a multi-tenant edge platform.
Earning criteria — what you'll demonstrate
- Compare user-space kernel, microVM, and WebAssembly isolation tradeoffs
- Measure cold-start, density, and steady-state cost rigorously
- Reason about tenant-isolation blast radius beyond CVE counts
- Write a platform-strategy memo that respects workload variety
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
Careers
Roles this prepares you for.
Real titles. Real skill bridges. Pick the one closest to your trajectory.
Career mappings coming soon.