  Development, deployment and maintenance of networked software has been
revolutionized by DevOps, which have become essential to boost system software
quality and to enable agile evolution. Meanwhile the Internet of Things (IoT)
connects more and more devices which are not covered by DevOps tools:
low-power, microcontroller-based devices. In this paper, we contribute to
bridge this gap by designing Femto-Containers, a new architecture which enables
containerization, virtualization and secure deployment of software modules
embedded on microcontrollers over low-power networks. As proof-of-concept, we
implemented and evaluated Femto-Containers on popular microcontroller
architectures (Arm Cortex-M, ESP32 and RISC-V), using eBPF virtualization, and
RIOT, a common operating system in this space. We show that Femto-Containers
can virtualize and isolate multiple software modules, executed concurrently,
with very small memory footprint overhead (below 10%) and very small startup
time (tens of microseconds) compared to native code execution. We show that
Femto-Containers can satisfy the constraints of both low-level debug logic
inserted in a hot code path, and high-level business logic coded in a variety
of common programming languages. Compared to prior work, Femto-Containers thus
offer an attractive trade-off in terms of memory footprint, energy consumption,
agility and security.
