  Security is a core responsibility for Function-as-a-Service (FaaS) providers.
The prevailing approach has each function execute in its own container to
isolate concurrent executions of different functions. However, successive
invocations of the same function commonly reuse the runtime state of a previous
invocation in order to avoid container cold-start delays when invoking a
function. Although efficient, this container reuse has security implications
for functions that are invoked on behalf of differently privileged users or
administrative domains: bugs in a function's implementation, third-party
library, or the language runtime may leak private data from one invocation of
the function to subsequent invocations of the same function.
  Groundhog isolates sequential invocations of a function by efficiently
reverting to a clean state, free from any private data, after each invocation.
The system exploits two properties of typical FaaS platforms: each container
executes at most one function at a time and legitimate functions do not retain
state across invocations. This enables Groundhog to efficiently snapshot and
restore function state between invocations in a manner that is independent of
the programming language/runtime and does not require any changes to existing
functions, libraries, language runtimes, or OS kernels. We describe the design
of Groundhog and its implementation in OpenWhisk, a popular production-grade
open-source FaaS framework. On three existing benchmark suites, Groundhog
isolates sequential invocations with modest overhead on end-to-end latency
(median: 1.5%, 95p: 7%) and throughput (median: 2.5%, 95p: 49.6%), relative to
an insecure baseline that reuses the container and runtime state.
