  Low-power operating system runtimes used on IoT microcontrollers typically
provide rudimentary APIs, basic connectivity and, sometimes, a (secure)
firmware update mechanism. In contrast, on less constrained hardware, networked
software has entered the age of serverless, microservices and agility. With a
view to bridge this gap, in the paper we design Femto-Containers, a new
middleware runtime which can be embedded on heterogeneous low-power IoT
devices. Femto-Containers enable the secure deployment, execution and isolation
of small virtual software functions on low-power IoT devices, over the network.
We implement Femto-Containers, and provide integration in RIOT, a popular open
source IoT operating system. We then evaluate the performance of our
implementation, which was formally verified for fault-isolation, guaranteeing
that RIOT is shielded from logic loaded and executed in a Femto-Container. Our
experiments on various popular microcontroller architectures (Arm Cortex-M,
ESP32 and RISC-V) show that Femto-Containers offer an attractive trade-off in
terms of memory footprint overhead, energy consumption, and security
