Serverless snapshot system cuts delays and saves cache space
SnapShare: Isolation-Preserving Deduplication for Serverless Snapshots
Distributed, Parallel, and Cluster Computing
Summary
Starting serverless cloud functions quickly is hard because loading large virtual machine snapshots takes time and uses a lot of storage. The authors show that many parts of these snapshots are the same across different users and don’t need extra privacy protections. They created SnapShare, a system that shares non-sensitive snapshot parts across many cloud workers while keeping sensitive data separate. This approach speeds up function startup, saves storage space, and reduces the amount of data fetched over the network.
What this means in practice
- •For cloud platform engineers: Manage serverless function snapshots that reduce startup delays by sharing safe data while keeping tenant data isolated.
- •For data center operators: Lower network loads and storage needs by deduplicating common snapshot data across multiple servers without risking tenant data leaks.
Authors
Leonid Kondrashov, Likun Zhang, André Filipe do Pilar de Jesus, Hans Pistor, Marco Cali, Riccardo Mancini, Rodrigo Bruno, Dmitrii Ustiugov
Abstract
The efficiency of serverless computing fundamentally depends on rapid function startup, a challenge increasingly addressed by restoring from virtual machine snapshots. However, because content deduplication techniques can open timing-channel attacks that leak sensitive tenant data, production platforms like AWS Lambda instead enforce strict, zero-sharing isolation between snapshots of different tenants. While secure, this isolation precludes the deduplication of common infrastructure components, wasting per-worker cache capacity and exacerbating cold-start latency through inefficient remote fetching. Our characterization reveals that non-sensitive, shareable infrastructure accounts for roughly 70% of a typical snapshot's contents and, on average, about 50% of its working set. We present SnapShare, a cluster-wide snapshot management system that co-designs storage and caching to exploit this commonality without compromising sensitive data isolation. SnapShare classifies a snapshot page as shareable only when its full content matches that of a page from a provider-approved source; any non-matching content is treated as isolated private content. Common infrastructure components are selectively deduplicated and pinned across the cluster's worker nodes, while private data remains strictly isolated and is eagerly fetched as part of the tracked working set, falling back to on-demand retrieval only for pages that fall outside it. Implemented as an extension to Knative, SnapShare reduces end-to-end tail request slowdowns by 10-29% compared to traditional working-set and chunk-based platforms. It also reduces remote storage requirements by 39% and local cache footprints by 38%, reducing network retrieval payloads and bounding worst-case fetch delays by 10x.