Component-based operating systems promise the containment of software faults and vulnerabilities by separating functionality into sandboxed components. In practice however, a contained fault is still a fault. Whenever a fault happens in a central server component, clients have to suffer under the outage of the server.

Device drivers are especially problematic because they tend to be fragile while being a hard dependency for critical software stacks on running on top. Even though a bug in the driver cannot subvert the information security of the dependent components, it cuts the lifelines of those components.

This fundamental problem calls for an architectural solution. We found the key in the reversal of the dependency relationships for several classes of device drivers. During this line of work, we re-stacked Genode's low-level GUI stack and turned network device drivers into disposable components. Thanks to these changes, drivers for framebuffer, input, network, and wireless devices can now be started, killed, updated, and restarted at anytime without disrupting applications.

The talk provides a holistic view of Genode's recent architectural changes, gives insights into the though process, outlines the methodology applied for turning big parts of the system upside down, presents limitations, and gives an outlook to the future of Genode and Sculpt OS.