TinyContainer: Container Runtime Middleware Enabling Multi-tenant Microcontrollers with Built-in Security
2026-06-08 • Operating Systems
Operating Systems
AI summaryⓘ
The authors present TinyContainer, a lightweight system that helps run multiple isolated applications on small, resource-limited microcontrollers. Unlike existing solutions, TinyContainer lets users configure how each application is scheduled and what resources it can access while running. They tested it on popular IoT devices with different microcontrollers and found it adds only a small delay when applications request services from the host system. One practical example shows TinyContainer managing machine learning tasks by keeping data inside containers but performing model predictions using native system tools.
software containerizationmicrocontrollersmulti-tenantresource-limited devicesaccess controlruntime schedulingWebAssemblyRIOT OSTinyMLIoT boards
Authors
Bastien Buil, Chrystel Gaber, Samuel Legouix, Emmanuel Baccelli, Samia Bouzefrane
Abstract
Software containerization technologies for resource-limited devices enable multi-tenant microcontrollers, which allow running multiple applications with different permission levels. However, current solutions lack run time configuration over various settings on container scheduling and container permissions to host resources. This limits the applicability of constrained containerization in dynamic and heterogeneous environments. This paper introduces TinyContainer, a lightweight software container management middleware designed for multi-tenant microcontrollers. TinyContainer provides per-container configurable scheduling and fine-grained access control to host resources through a metadata-driven approach, supporting multiple runtimes via a runtime abstraction layer. We analyze the performance of TinyContainer with a small WebAssembly runtime, CS4WAMR, and RIOT OS, a common RTOS. We report on experiments using popular IoT boards based on various Cortex-M microcontrollers. We show the endpoint system brought by TinyContainer allowing to regulate access of containers to host resources and provide host services to containers with an overhead of up to 4 ms per call. In particular, we showcase a TinyML use case, whereby containers retain data and model weights, while model inference is delegated to native host RTOS services.