Patent Description:
Some cloud computing providers provide services allowing secure execution of third-party code from various tenants on a shared compute infrastructure. A cloud computing platform then provides execution environments for execution of such third-party codes. Code from one tenant is prevented from accessing and/or modifying the code, data, and keys of other tenants. As such, the execution environments are isolated from one another.

Such isolated execution environments may be provided by virtual machine based isolation where code of different tenants runs in different virtual machines, or by container based isolation where code of different tenants runs in different containers within an operating system. <CIT> discloses technologies for isolating tenants executing in a multi-tenant software container. Mechanisms for resource isolation allow tenants executing in a multi-tenant software container to be isolated in order to prevent resource starvation by one or more of the tenants. Mechanisms for dependency isolation may be utilized to prevent one tenant executing in a multi-tenant software container from using another tenant in the same container in a manner that requires co-tenancy. Mechanisms for security isolation may be utilized to prevent one tenant in a multi-tenant software container from accessing protected data or functionality of another tenant.

In intra-process based isolation, a single process provides a plurality of isolated execution environments each executing a third-party code. Code in such an intra-process execution environment cannot interfere with other code despite being executed within the same process. This may for example be achieved by preventing the code from requesting access to arbitrary memory or by interpreting pointers within a private address space.

In one specific example of intra-process based isolation the process is a runtime engine, e.g. a JavaScript engine, that interprets or executes different third-party codes, e.g. JavaScript code, in an isolated manner written for the runtime system.

Amongst others, it is an object of embodiments of the invention to provide a solution capable of isolated execution of computer code with a native code portion in an intra-process execution environment.

This object is achieved, according to a first example aspect of the present disclosure, by a computer-implemented method as defined by claim <NUM>, comprising:.

wherein the tenant-specific process is configured to only execute computer codes associated with the same tenant in different intra-process execution environments isolated within the tenant-specific process, and the global process is configured to execute computer codes associated with different tenants in different isolated intra-process execution environments.

In response to a request, a computer code is executed for a tenant in an intra-process execution environment. The request may for example be triggered by an external event, e.g. an HTTP request, a database update, a remote procedure call, or an application-specific notification. The intra-process execution environment runs in a tenant-specific process or in a global process. A single global process and a single tenant-specific process can run one or more of such intra-process execution environments. Because the intra-process execution environments of the global process are isolated, the global process can securely execute computer code associated with different tenants when the code does not include a native code portion. A native code portion may for example be, amongst others, machine code or a code compiled from a low-level programming language such as C or C++. In the context of the present application, 'isolation' and 'secure execution' refer to preventing code executed on behalf of one tenant to access or modify the code or data of another tenant. Computer code executed in an isolated intra-process execution environment of the global process is thus prevented from accessing and/or modifying the code, data, and keys in other intra-process execution environments in the global process. As such, computer codes associated with different tenants can be executed securely in a single global process, without starting a single process for every tenant. It is thus an advantage that for computer code without a native code portion the limited start-up latency, resource overhead, and cost per tenant to execute computer code in isolated intra-process execution environments can be maintained.

Computer code comprising a native code portion is executed in a tenant-specific process. The tenant-specific process is associated with a single tenant, i.e. the tenant-specific process is configured to only execute computer code from one specific tenant. As a result, native code portions can be securely executed even if they break the isolation of the intra-process execution environment as the computer code remains sandboxed within the tenant-specific process. The tenant-specific process only includes information belonging to the same tenant and thus the executed computer code may not gain access to information belonging to other tenants.

It is thus an advantage that computer code with a native code portion can be securely executed while maintaining the limited runtime overhead of intra-process execution environments. It is a further advantage that computer code with substantially optimized operations can be executed securely, as execution of native code portions can be substantially efficient and fast. It is a further advantage that legacy code or computer code written in a low-level programming language can be executed securely in intra-process execution environments, without converting it to a high-level programming language that does not break the isolation of the intra-process execution environments. It is a further advantage that existing scheduling strategies, in particular for cloud computing platforms, can easily implement the method for isolated execution of computer code with a native code portion.

Computer code of a tenant without a native code portion can also be executed in the tenant-specific process associated with said tenant, in addition to the global process. In doing so, the running processes can be utilized more efficiently, thereby further reducing the runtime overhead. This has the advantage that it can further reduce the cost per tenant to execute computer code.

According to an example embodiment, the request may comprise a reference to the computer code. The computer code may for example be stored in a database when provided to a cloud computing provider or serverless computing provider by a tenant. The computer code may only be loaded into memory following a request to execute the computer code. As such, the reference to the computer code may for allow to identify and retrieve the computer code from the database, e.g. from a database server or a control server.

According to a further example embodiment, the request may further comprise input data for the computer code. The input data may be, amongst others, a parameter, a number, information, an identifier, and/or a key required to execute the computer code. The desired input data may depend on the computer code to be executed.

According to a further example embodiment, the computer code may comprise a scripted code portion and the global process may be configured to execute scripted code portions in the different isolated intra-process execution environments. The scripted code portion may be a piece of code written in a scripting language, e.g. JavaScript, Python, PHP, Perl, or Ruby. The scripted code portion may be directly interpreted from source code and translated into machine language by an interpreter at runtime, without requiring a compilation step. The global process may be configured to interpret and execute said scripted code portions in the different isolated intra-process execution environments.

According to a further example embodiment, the method may further comprise detecting the native code portion in the computer code. It may be unknown if the computer code comprises a native code portion. The computer code may thus be searched or checked for the presence of a native code portion. This detection may for example be performed when the computer code is provided to the cloud computing provider or serverless computing provider, when the computer code is loaded into memory, and/or when the computer code is executed.

According to a further example embodiment, the method may further comprise detecting a loading mechanism of the native code portion during execution of the computer code in the global process, interrupting the execution of the computer code in the global process, and reallocating the computer code to the tenant-specific process for execution. In other words, execution of the computer code in the global process can be interrupted when the computer code attempts to load a native code portion. The native code portion may for example be detected by intercepting the loading mechanism of the native code portion. In doing so, breaking the isolation of the different isolated intra-process execution environments in the global process can be prevented. The computer code may then be reallocated to the tenant-specific process for secure execution.

According to a further example embodiment, the method may further comprise detecting a loading mechanism of the native code portion during execution of the computer code in the global process, and converting the global process to the tenant-specific process, when the computer codes in the global process are associated with the same tenant. In other words, the global process may be converted to a tenant-specific process when the computer code attempts to load a native code portion and all the computer codes being executed in the global process belong to the same tenant. The native code portion may for example be detected by intercepting the loading mechanism of the native code portion. The computer code can thus securely be executed in the global process as long as all computer code in the global process belongs to the same tenant. In doing so, execution of the computer code with the native code portion does not have to be interrupted or delayed. When a global process is converted to a tenant-specific process, a new global process may be initialized to execute computer codes associated to different tenants.

According to a further example embodiment, the received computer code may comprise a tag indicative for the presence of the native code portion, and wherein the method further comprises allocating the computer code to the tenant-specific process based on the tag for further execution. The computer code with the native code portion may for example be tagged by the tenant before providing it to the cloud computing provider or serverless computing provider. The tag can thus indicate that a computer code comprises a native code portion, thereby allowing to allocate the tagged computer code directly to the tenant-specific process. It is a further advantage that this can reduce the load on the global process, as it can prevent that execution of a computer code with a native code portion is interrupted and reallocated from a global process to a tenant-specific process.

According to a further example embodiment, the method may further comprise initialising the tenant-specific process. The tenant-specific process associated to a tenant may be unavailable, e.g. when detecting the native code portion or when receiving a tagged computer code with a known native code portion. In this case, a new tenant-specific process may be initialized. Alternatively, an additional tenant-specific process may be initialized for a tenant based on the utilization of the current tenant-specific process, e.g. when the computer codes with a native code portion to be executed for said tenant exceed the capacity of the current tenant-specific process.

According to a further example embodiment, the method may further comprise allocating the computer code to a tenant-specific queue for execution in the tenant-specific process. The tenant-specific queue may be associated with a tenant and a tenant-specific process. The tenant-specific queue may comprise a collection of computer codes of a single tenant, to be executed in a certain order in the associated tenant-specific process. Therefore, the tenant-specific process can be configured to repeatedly fetch and execute computer code from the associated tenant-specific queue. As such, allocating computer code to a tenant-specific queue can ensure that the computer code is executed in the associated tenant-specific process. The computer code may for example be allocated to the tenant-specific queue when receiving a request to execute a tagged computer code with a known native code portion, or when detecting a native code portion in the computer code.

According to a further example embodiment, the method may further comprise allocating the computer code to a global queue for execution in the global process. The global queue may comprise a collection of computer codes of different tenants, to be executed in a certain order in the global process. Therefore, the global process can be configured to repeatedly fetch and execute computer code from the global queue. A plurality of global processes may, but need not fetch and execute computer code from a single global queue. The computer code may be allocated to the global queue after receiving a request to execute computer code for which the presence of a native code portion is unknown. Alternatively, the computer code may be allocated to the global queue when the presence of a native code portion is known in the computer code but the tenant-specific queue is unavailable, or when the computer code does not include a native code portion.

According to a second example aspect, a computer program product is disclosed comprising computer-executable instructions for performing the following steps when the program is run on a computer:.

According to a third example aspect, a computer readable storage medium is disclosed comprising computer-executable instructions for performing the following steps when the program is run on a computer:.

According to a fourth example aspect, an apparatus is disclosed comprising means configured to perform:.

<FIG> shows an example embodiment of a cloud computing platform <NUM> capable of isolated execution of computer code with a native code portion according to example embodiments of the disclosure. In such a cloud computing platform <NUM> different tenants can for example register one or more computer codes to be executed in response to a request <NUM>. The request <NUM> to execute a computer code may be triggered by an external event such as for example, amongst others, an HTTP request, a database update, a remote procedure call, or an application-specific notification. The cloud computing platform <NUM> may comprise a plurality of compute servers <NUM>, <NUM>, <NUM> configured to execute the computer code for the tenant following the request. The computer code is executed in an intra-process execution environment of a single process. A compute server <NUM>, <NUM>, <NUM> may run a plurality of such single processes. Each single process may further run a plurality of intra-process execution environments. The intra-process execution environments may further be isolated from one another, i.e. code executed in a first intra-process execution environment cannot access or modify the code or data in another intra-process execution environment. The intra-process execution environment may for example be a JavaScript execution runtime built on the V8 JavaScript engine, in particular on the isolates concept from the V8 JavaScript engine.

The compute servers <NUM>, <NUM>, <NUM> may be physical servers that may, but need not be geographically distributed. The compute servers <NUM>, <NUM>, <NUM> may be part of a point of presence, PoP, that includes additional hardware such as for example, amongst others, other physical servers, data storage, database servers, computing devices, input/output devices, and network equipment (not shown in <FIG>). The compute servers <NUM>, <NUM>, <NUM> may receive the request <NUM> to execute the computer code from a client device <NUM>. The client device <NUM> may be a computing device such as for example, amongst others, a smartphone, a laptop, a desktop, a tablet, an Internet of Things, loT, device, or a wearable device. Following the execution of the requested computer code, the compute server <NUM> may further be configured to communicate a response <NUM> to the client device <NUM> based on the output of the executed computer code.

The cloud computing platform <NUM> may further include a control server <NUM>. The control server <NUM> may be configured to offer control services to the cloud computing platform such as for example, amongst others, receive a computer code from a tenant, configure the computer code to be executed in the cloud computing platform, determine on which compute server <NUM>, <NUM>, <NUM> to execute the computer code, and provide the computer code to the determined compute server <NUM>, <NUM>, <NUM>. Alternatively, the control services can be provided by the cloud computing platform without a dedicated control server <NUM>. A tenant device <NUM> may further communicate with the control server <NUM> to provide, i.e. upload, a computer code to be executed by the cloud computing platform <NUM>. The tenant device <NUM> may be a computing device such as for example, amongst others, a smartphone, a laptop, a desktop, or a tablet.

The tenant may further specify the external event that triggers a request to execute the computer code such as for example, amongst others, an HTTP request, a database update, a remote procedure call, or an application-specific notification. Additionally, the tenant may indicate the presence of a native code portion in the provided computer code, thereby tagging the computer code. Such a native code portion may for example be, amongst others, machine code or a code compiled from a low-level programming language such as C or C++. It can be advantageous to execute such a native code portion when highly optimized operations are desired as the execution of native code may be relatively efficient and fast. It may further be advantageous to execute native code portions when legacy code is to be executed or an application programming interface, API, is written in a low-level programming language. This can have the advantage that the API or legacy code can be executed without converting it to a high-level programming language, e.g. a scripting language.

When executing computer codes for different tenants on a shared compute infrastructure, e.g. in a cloud computing platform <NUM>, code executed on behalf of one tenant may be prevented to access or modify the code or data of another tenant. In other words, it may be desirable that computer codes are executed in an isolated manner.

<FIG> shows steps <NUM> of the computer-implemented method for isolated execution of computer code according to example embodiments of the present disclosure. In a first step <NUM>, a request <NUM> is received to execute a computer code <NUM> for a tenant <NUM>. The request may be received by a gateway module included in the compute server that executes the computer code, e.g. an HTTP request received by an API gateway. The request <NUM> may comprise a reference to the computer code <NUM> to be executed, a reference to the tenant <NUM> on behalf of whom the computer code <NUM> is to be executed, and input data (not shown in <FIG>) to execute the computer code <NUM>. The reference to the computer code <NUM> may allow the compute server to retrieve the desired computer code <NUM> from data storage or request the desired computer code <NUM> from a control server. The input data may be, amongst others, a parameter, a number, information, an identifier, and/or a key required to execute the computer code. The desired input data may further depend on the computer code to be executed. Alternatively, a computer code may be executed without input data.

The computer code <NUM> can for example be, amongst others, a piece of compiled code, machine code, scripted code, or a combination thereof. In other words, the computer code <NUM> can for example be a scripted code comprising a compiled code portion and/or machine code portion, i.e. a native code portion. The computer code <NUM> may for example respond to a request, e.g. an HTTP request. A scripted code or code portion may be a piece of code written in a scripting language such as for example, amongst others, JavaScript, Python, PHP, Perl, or Ruby. The scripted code portion may be directly interpreted from source code and translated into machine language by an interpreter at runtime, without requiring a compilation step.

In a second step <NUM>, the presence of a native code portion <NUM> in the computer code <NUM> may be determined. According to example embodiments, the presence of a native code portion <NUM> may be detected for example, amongst others, when the computer code <NUM> is provided, i.e. uploaded, to the cloud computing provider, when the computer code <NUM> is loaded into memory, and/or when the computer code <NUM> is executed.

During a third step <NUM>, the computer code <NUM> is executed in an intra-process execution environment <NUM>, <NUM> running in a global process <NUM> or in a tenant-specific process <NUM>, based on the presence of a native code portion <NUM> in the computer code <NUM>. The computer code may for example be pushed or allocated to the global process <NUM> or the tenant-specific process <NUM> by means of a dispatcher.

The global process <NUM> is configured to execute computer codes <NUM> without a native code portion associated with different tenants <NUM>, <NUM>, <NUM>. The computer codes are executed in different isolated intra-process execution environments <NUM> of the global process <NUM>. The computer codes <NUM> can be executed securely thanks to the isolation properties of the intra-process execution environments <NUM>. In other words, the isolated intra-process execution environments <NUM> of the global process <NUM> prevent the computer code executed therein from accessing and/or modifying the code, data, and keys in other intra-process execution environments <NUM> running in the same global process <NUM>. As such, computer codes <NUM> associated with different tenants <NUM>, <NUM>, <NUM> can be executed in a single global process <NUM>, i.e. without starting a single process for every different tenant <NUM>, <NUM>, <NUM>. This can reduce start-up latency and resource overhead and has the advantage that it can reduce the cost per tenant to execute computer code <NUM>.

The tenant-specific process <NUM> is configured to execute computer codes <NUM> with a native code portion associated with the same tenant <NUM> in different intra-process execution environments <NUM>. The tenant-specific process <NUM> is associated with a single tenant <NUM>, i.e. the tenant-specific process <NUM> is configured to only execute computer code belonging to a single specific tenant <NUM>. In doing so, native code portions <NUM> can securely be executed even if the isolation of the intra-process execution environment <NUM> is broken, as the computer code <NUM> remains sandboxed in the tenant-specific process <NUM>. As the tenant-specific process <NUM> only includes information belonging to the same tenant <NUM>, information of other tenants can remain secure. The executed computer code <NUM> for tenant <NUM> can thus not gain access to information belonging to other tenants.

It is thus an advantage that computer code <NUM> with a native code portion can securely be executed while maintaining the limited runtime overhead of intra-process execution environments <NUM>. It is a further advantage that computer code with substantially optimized operations can be executed securely, as execution of native code portions <NUM> can be substantially efficient and fast. It is a further advantage that legacy code or computer code written in a low-level programming language can be executed securely in intra-process execution environments <NUM>, without converting it to a high-level programming language that does not break the isolation of the intra-process execution environments <NUM>.

The tenant-specific process <NUM> is further configured to execute computer code <NUM> without a native code portion as long as the computer code <NUM> belongs to the tenant <NUM> associated to the tenant-specific process <NUM>. In other words, the tenant-specific process <NUM> can execute computer code with <NUM> and without <NUM> a native code portion as long as they belong to the same tenant <NUM>. This can offer more flexibility and efficiency when handling requests to execute computer code, as the running processes are utilized more efficiently. This has the advantage that the runtime overhead, e.g. memory overhead, start-up overhead, and context-switching overhead, can be reduced and the cost per tenant to execute computer code can be reduced.

<FIG> shows steps for the isolated execution of computer code with a native code portion in intra-process execution environments according to example embodiments of the present disclosure. In a first step <NUM>, a dispatcher <NUM> may receive a request, e.g. from a gateway module, to execute a computer code for a tenant. The dispatcher may, in a second step <NUM>, verify or check if the computer code to be executed comprises a known native code portion. A known native code portion refers to computer code for which the presence of a native code portion is known before execution. This may for example be the case when the computer code comprises a tag indicative for the presence of the native code portion. The computer code may for example be tagged by the tenant when providing it to the cloud computing provider, e.g. when uploading the computer code to the cloud computing platform. Alternatively, the computer code may be tagged when the native code portion is detected during execution or when the computer code is loaded into memory. Tagging a computer code when detecting a native code portion can thus prevent undesired repetition of the detection process when executing the same computer code at a later time. Such a tagged computer code can thus be allocated to a tenant-specific process more efficiently, i.e. without searching for a native code portion during consecutive evocations of the same computer code.

When the computer code comprises a known native code portion, e.g. the computer code is tagged, dispatcher <NUM> may verify in a next step <NUM> if a tenant-specific queue is available. The tenant-specific queue may be associated with a tenant and a tenant-specific process <NUM>. The tenant-specific queue may comprise a collection of computer codes of a single tenant, to be executed in a certain order in the associated tenant-specific process <NUM>. Therefore, the tenant-specific process <NUM> may repeatedly fetch and load computer code from the associated tenant-specific queue. As such, allocating computer code to a tenant-specific queue can ensure that the computer code is executed in the associated tenant-specific process <NUM>.

When the presence of a native code portion in the computer code is unknown, or the tenant specific queue for a computer code with a known native code portion is unavailable, the dispatcher may push or allocate the computer code to a global queue in step <NUM>. The global queue may comprise a collection of computer codes of different tenants, to be executed in a certain order in the global process <NUM>. Therefore, the global process <NUM> may repeatedly fetch and load computer code from the global queue in step <NUM>.

The next step <NUM> may include detecting the native code portion in the computer code. Thus, when fetching the computer code from the global queue and loading the code into memory, the computer code may be searched or scanned for the presence of a native code portion. This may for example be achieved by intercepting a loading mechanism, e.g. the 'require()' function in JavaScript, and replacing this loading mechanism with a proxy function, i.e. a proxy loading mechanism. The proxy loading mechanism may perform substantially the same functions of the intercepted loading mechanism, in addition to detecting the presence of a native code portion. As such, existing scheduling strategies, in particular for cloud computing platforms, can easily implement the method for isolated execution of computer code with a native code portion.

When no native code portions have been detected, the computer code can securely be executed in the global process <NUM> in step <NUM>. However, if a native code portion is detected in the computer code, step <NUM> may verify whether all the computer codes in the global process are associated with the same tenant. These codes include the computer code for which a native code portion is detected and all other computer codes currently being executed in the global process <NUM>. If this is not the case, loading and execution of the computer code may be rejected or interrupted in step <NUM>, as execution of the computer code with a native code portion can grant the code access to the other codes being executed in the global process <NUM> that belong to different tenants. In other words, executing the computer code with a native code portion in the global process <NUM> can break the isolation of the intra-process execution environments. As a next step <NUM>, the rejected computer code may be returned to the global queue to be fetched again by a global process. This global process may, but need not be a different global process.

These steps <NUM>, <NUM>, <NUM>, <NUM> are repeated until a suitable global process fetches the computer code with a native code portion, i.e. a global process that only comprises computer codes belonging to the same tenant. Such a suitable global process can be detected in step <NUM>, whereafter the global process may be converted to a tenant-specific process in step <NUM>. Converting the global process to a tenant-specific process may for example be performed by a dispatcher <NUM>. Once the global process <NUM> is converted to a tenant-specific process <NUM>, it may only execute computer code belonging to the same tenant. When a global process is converted to a tenant-specific process, the dispatcher may for example initialize a new global process to execute computer codes associated to different tenants, i.e. to replace the function of the converted process.

A counter may further be used to ensure that the rejected computer code can be executed within an acceptable time-frame, i.e. to prevent an endless loop when no suitable global process can be identified. The counter may be incremented <NUM> each time execution of the computer code is rejected in step <NUM>. When the counter exceeds a predefined threshold <NUM>, the dispatcher <NUM> can initialize a new tenant-specific process for the rejected computer code in step <NUM>.

A tenant-specific queue may be created in step <NUM>, following either the initialization of a new tenant-specific process <NUM> or the conversion of a suitable global process <NUM>. Computer code comprising a native code portion may then be allocated to the created tenant-specific queue <NUM>, to be fetched <NUM> and executed <NUM> by the associated tenant-specific process <NUM>. Computer code may further be allocated <NUM> directly to the associated tenant-specific queue when said tenant-specific queue is available in step <NUM> for a computer code with a known native code portion.

<FIG> shows steps for the isolated execution of computer code with a native code portion in intra-process execution environments according to example embodiments of the present disclosure. Herein, a computer code with a known native code portion, determined in step <NUM>, may trigger the dispatcher <NUM> to initialise a tenant-specific process <NUM> when the tenant-specific queue is unavailable <NUM>. In doing so, the load on the global queue can be reduced compared to the example embodiments illustrated in <FIG> as computer code with a known native code portion may not be allocated to the global queue. It is a further advantage that the cloud computing provider may easily switch between the example embodiments illustrated in <FIG> and <FIG>, depending on the scale and utilization of the cloud computing infrastructure.

<FIG> shows a suitable computing system <NUM> enabling to implement embodiments of the method for isolated execution of computer code with a native code portion in an intra-process execution environment. Computing system <NUM> may in general be formed as a suitable general-purpose computer and comprise a bus <NUM>, a processor <NUM>, a local memory <NUM>, one or more optional input interfaces <NUM>, one or more optional output interfaces <NUM>, a communication interface <NUM>, a storage element interface <NUM>, and one or more storage elements <NUM>. Bus <NUM> may comprise one or more conductors that permit communication among the components of the computing system <NUM>. Processor <NUM> may include any type of conventional processor or microprocessor that interprets and executes programming instructions. Local memory <NUM> may include a random-access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor <NUM> and/or a read only memory (ROM) or another type of static storage device that stores static information and instructions for use by processor <NUM>. Input interface <NUM> may comprise one or more conventional mechanisms that permit an operator or user to input information to the computing device <NUM>, such as a keyboard <NUM>, a mouse <NUM>, a pen, voice recognition and/or biometric mechanisms, a camera, etc. Output interface <NUM> may comprise one or more conventional mechanisms that output information to the operator or user, such as a display <NUM>, etc. Communication interface <NUM> may comprise any transceiver-like mechanism such as for example one or more Ethernet interfaces that enables computing system <NUM> to communicate with other devices and/or systems, for example with other computing devices <NUM>, <NUM>, <NUM>, <NUM>, <NUM>. The communication interface <NUM> of computing system <NUM> may be connected to such another computing system by means of a local area network (LAN) or a wide area network (WAN) such as for example the internet. Storage element interface <NUM> may comprise a storage interface such as for example a Serial Advanced Technology Attachment (SATA) interface or a Small Computer System Interface (SCSI) for connecting bus <NUM> to one or more storage elements <NUM>, such as one or more local disks, for example SATA disk drives, and control the reading and writing of data to and/or from these storage elements <NUM>. Although the storage element(s) <NUM> above is/are described as a local disk, in general any other suitable computer-readable media such as a removable magnetic disk, optical storage media such as a CD or DVD, -ROM disk, solid state drives, flash memory cards,. could be used. Computing system <NUM> could thus correspond to the compute server <NUM>, <NUM>, or <NUM> according the embodiments illustrated by <FIG>.

Claim 1:
A computer-implemented method comprising:
- receiving a request (<NUM>) to execute a computer code (<NUM>) for a tenant (<NUM>) in an intra-process execution environment (<NUM>, <NUM>), wherein the tenant provides the computer code to a shared compute infrastructure for execution upon request; and wherein one or more intra-process execution environments run in a process;
- executing the computer code in a tenant-specific process (<NUM>) when the computer code comprises a native code portion (<NUM>);
- executing a computer code without a native code portion in a running tenant-specific process if the computer code without a native code portion belongs to the tenant associated to the running tenant-specific process;
- otherwise, executing the computer code in a global process (<NUM>); and
wherein the tenant-specific process is configured to only execute computer codes (<NUM>, <NUM>) associated with the same tenant (<NUM>) in different intra-process execution environments (<NUM>) isolated within the tenant-specific process, and the global process is configured to execute computer codes (<NUM>) associated with different tenants (<NUM>, <NUM>, <NUM>) in different isolated intra-process execution environments (<NUM>).