Inside Out: A Paradigm Shift in Live VM Introspection

To be published — OSDI ‘26 (CORE A*, acceptance rate: 20%).

We introduce GOODKIT, a novel Live VM Introspection (VMI) framework that rethinks how a target virtual machine can be observed securely and efficiently. Instead of trading performance for isolation, GOODKIT leverages co-located side-VMs to achieve native-speed access to the target while preserving strong isolation between the observer and the observed. We implement fine-grained, lock-aware memory coherence mechanisms and kernel probing subsystems within the Firecracker VMM and the Linux kernel, bridging the gap between secure monitoring and production cloud performance. We hope this work paves the way for practical, high-performance introspection in production cloud environments.