CofferOS: Hardening OS-level Virtualization with Rust

This repository contains the official source code for CofferOS, a POSIX-binary-compatible containerized kernel accepted at EuroSys 2026. CofferOS leverages Rust's memory safety and structural encapsulation to provide strong security and fault isolation for OS-level virtualization.

Quick Start

The following instructions guide you through building and running CofferOS on a Linux environment.

1. Prerequisites

First, clone the repository with its submodules:

git clone --recurse-submodules --depth 1 https://github.com/casys-kaist/CofferOS.git
cd CofferOS

Install Rust and the required components:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env
rustup component add rust-src

Install the necessary system dependencies (Ubuntu/Debian):

sudo apt-get update
sudo apt-get install -y qemu-system-x86 xorriso mtools grub-pc grub2-common python3 python3-toml

Hardware requirement: an Intel CPU with AVX-512 and CMPXCHG16B support.

2. Build and Run

Once the environment is set up, you can build and run CofferOS using Cargo:

CARGO_BUILD_TARGET=.cargo/x86_64-unknown-multiboot.json \
DISK=disk.bin \
cargo run -Zjson-target-spec

(Note: This command will compile the kernel and automatically launch it in QEMU.)

This command automatically build a ext4-formatted disk image from the rootfs/.

Running on Baremetal

CofferOS is not limited to virtual machines; it can also be installed and booted on baremetal hardware using GRUB tools. (You can add specific commands or a link to a detailed documentation page here if needed, e.g., make install-grub or specific ISO creation steps.)

Citation

If you want to use our work, please cite the following paper:

@inproceedings{jung2026cofferos,
  title={CofferOS: Hardening OS-level Virtualization with Rust},
  author={Jung, Minkyu and Kwak, Chanshin and Ahn, Junho and Park, Sunho and Lee, Changjun and Kim, Jongyul and Kang, Jeehoon and Kwon, Youngjin},
  booktitle={Proceedings of the 21st European Conference on Computer Systems},
  pages={19--35},
  year={2026}
}

License

CofferOS is open-source software licensed under the apache License.