A Microkernel Boundary, Not a Microkernel

The final question is narrower and more useful than whether Linux can be transformed into a microkernel. kSFS asks whether one important class of Linux component—file systems—can run near the kernel's fast path while remaining on the far side of a meaningful distrust boundary. The answer supported by the design and measurements is conditional: kSFS preserves a microkernel-like interaction model for a bounded target, but it does not reproduce a complete microkernel architecture or remove the need to trust shared enforcement machinery.

What kSFS actually preserves

A microkernel-like boundary has two essential properties in this discussion. First, the service implementation is not assumed to be safe merely because it is part of the operating system. Second, the trusted core interacts with it through a contract narrow enough to validate and recover from failure. kSFS preserves both ideas for file systems without moving every filesystem operation into a separate user-space process.

The first preserved property is distrust. A kSFS filesystem implementation may contain memory-safety bugs, stack overflows, invalid control flow, or an infinite loop. The design treats that implementation as untrusted even though it executes in kernel space. That is a significant reversal of ordinary Linux assumptions, where a native filesystem is a privileged participant in the kernel's internal interfaces.

The second preserved property is a constrained interaction path. FUSE supplies the shape: Linux issues a defined filesystem operation, the implementation handles it, and the trusted side receives a response through a protocol rather than through arbitrary shared pointers and callbacks. kSFS changes the transport and execution location, but it does not give the ported implementation the broad interface that native in-kernel filesystems use. The contract is the architectural core; WebAssembly is the mechanism that makes the handler safer to place near the kernel.

The third property is recoverability. A user-space FUSE daemon can be interrupted or killed when it stops responding. kSFS cannot rely on ordinary process termination, so its runtime and driver add page-fault handling, stack checks, preemption, and an explicit instance-kill path. Those mechanisms are not decorative features around the sandbox. They are what make “untrusted code in kernel space” a coherent claim rather than a contradiction.

What kSFS leaves in the monolithic kernel is equally important. Linux still owns the VFS-facing path, request state, scheduling environment, storage stack, and trusted driver. The WebAssembly runtime and AOT compilation path remain trusted. The design does not create an independent operating-system service with its own complete recovery domain. It creates a protected compartment inside the existing kernel, connected to that kernel through a deliberately constrained route.

The boundary can therefore be stated as a division of responsibility:

• Linux and the kSFS driver own admission, request state, validation, and the trusted side of storage operations.
• The FUSE-shaped interface defines the filesystem operations that cross between the driver and the implementation.
• WebAssembly limits the implementation's linear memory and control flow and provides a place to terminate faults.
• Capability-oriented resource access limits which files, directories, or block devices the instance can reach.
• The filesystem implementation supplies format-specific behavior but does not acquire the authority of the surrounding kernel.

This division answers why the FUSE contract matters as much as the WebAssembly sandbox. WebAssembly can stop an out-of-bounds access from becoming an arbitrary host-memory write, but it does not decide whether a file descriptor refers to the right disk. A capability policy can limit that descriptor, but it does not make the filesystem's metadata updates correct. The FUSE-shaped interface gives the trusted side a structured interaction to validate and a lifecycle to recover when the implementation fails.

The phrase “microkernel-like” should thus be read as a property of the interaction, not a label for the whole operating system. Linux remains monolithic in its overall architecture. kSFS borrows a microkernel's distrust model at one boundary and combines it with software fault isolation inside the kernel.