As a cloud service provider, Cloudflare faces some unusual and demanding security challenges. One such challenge is the requirement to run arbitrary code written by their customers on a globally distributed network. This gives their customers access to a high-performance, distributed enviroment, but it also creates a tempting environment for bad actors to try to crack Cloudflare’s security.

As described in a recent post on their official blog, Cloudflare has been using Workers to run customer code in “sandboxed” environments. V8, which is the JavaScript engine Cloudflare uses to run its Workers, recently added sandbox feature prevents most heap-corruption bugs. This sandboxing effectively stops malicious or simply buggy customer code from overrunning its allotted memory and causing havoc, but its use limits the maximum heap size for a given process to 4GB.

In order to use V8’s sandbox without those heap size limitations, Cloudflare hired Igalia to implement isolate groups in V8. As authors Erik Corry and Ketan Gupta put it:

Each isolate group has its own sandbox and can have 1 or more isolates within it. Building on this change we have been able to start using the sandbox, eliminating a whole class of potential security issues in one stroke.

The details of this approach are further explained in a blog post by Igalian Dmitry Bezhetskov titled “Multi-cage mode and multiple sandboxes”. Dmitry, who did this work along with Andy Wingo and the rest of the Compilers team, also points out that these benefits are for everyone:

To sum up […] with the introduction of isolate groups and sandbox support V8 embedders could enjoy pointer compression alongside all the benefits of the newly added sandbox feature.

We’re excited to share this with you because it’s the kind of work that makes us excited, and that we love to do: helping clients make their software environments better for themselves and everyone else with similar needs. Whether it’s adding isolate groups to a JS engine or grid layout to web browsers, whether it’s advancing standards or real-world use of those standards, Igalia is open to the possiblities. If you’d like us to help you with your needs, get in touch! We’d love to talk about how we can work together.