Section 7: Assume the Tenant Is the Attacker - Deep Dive: Isolation & Multi-Tenancy

Executive Summary: Handed the wheel, the candidate picks isolation first, because it's the one decision that can't be retrofitted: it fixes the boot cost Section 8 must hide and the density Section 9 schedules around. We write down the threat model (every tenant already has code execution in its own sandbox), compare five boundaries, choose a Firecracker-style microVM per sandbox with five layers of defence in depth, and set the packing rule: one function version of one account per microVM, reused only sequentially. Then come side channels, resource abuse, the density bill (~3 GB per 384 GB host) and two pushbacks: "Kubernetes uses containers" and "isolates start in 5 ms".

The architecture is on the board. The interviewer caps the marker: "Where would you like to go deeper?"

You: "Three places, in this order. Isolation first: the boundary I pick sets how long a sandbox takes to boot and how many fit on a host. Cold starts and placement second, because that's where the boot cost gets hidden. Scaling, concurrency and async third, because they schedule what the first two produce. Get isolation wrong and I redo the other two."

Interviewer: "Fine. Start with what you're defending against."

The Threat Model, Written Down

You: "Elsewhere, remote code execution is the breach. Here it's the product. I assume tenant code is hostile, written by someone who studies hypervisor CVEs, with unlimited time to probe. Of the ten million functions in the region (N23), some are attacks."

The goals, in priority order:

1. No escape to the host. Sandbox code can't run code in the host kernel, the host agent or another sandbox.
2. No cross-tenant access. No reading another tenant's memory, disk, code, environment variables, credentials or network traffic.
3. Contained resource abuse. A fork bomb, a crypto miner or a packet flood hurts only its owner's sandboxes, and the owner's bill.
4. Bounded side channels. We can't get timing leaks through shared hardware to zero, but we close the cheap ones and say plainly what's left.

Key Insight: For most services, "the attacker has code execution" ends the threat model. For a function platform it's the first line. Every boundary is judged by what stands between that code and the next tenant.