~/systems
system·project·render: lazy

MILF (Pocket Cloud)

Mobile Infra for Lambdas and Files: A distributed serverless platform transforming standard mobile devices into high-performance WASM compute nodes.

status: activediagrams: mermaidgraphs: react-flowconsole: 3-panel
loading graph
❯
less overview_&_problem_statement.md
md

MILF (Mobile Infra for Lambdas and Files) — codenamed Pocket Cloud — is a distributed edge compute platform that turns idle mobile hardware into sandboxed serverless execution nodes.

The Problem

Traditional serverless platforms (AWS Lambda, GCP Functions) suffer from 300ms–3s cold starts due to Firecracker microVM boots, heavy language runtimes, vendor lock-in, and costly bandwidth egress.

The Pocket Cloud Solution

User code is compiled once on the Go Central Server into tiny WebAssembly binaries and dispatched dynamically over WebSockets to mobile worker nodes running the WebAssembly Micro Runtime (WAMR). This delivers < 5ms cold starts and near-native execution speed for compiled languages.

❯
less subsystem_architecture.md
md
  • Central Server (Go, PostgreSQL, Redis): Control plane managing Auth, WASM compilation pipelines, Orchestrator task queues, and WebSocket hubs.
  • Developer Dashboard (React, Vite, Monaco Editor): Developer control plane providing local-first state caching (React Query + IndexedDB), in-browser code editing, and live execution observability.
  • Consumer Node (Flutter, Kotlin, C++, WAMR): Edge worker runtime utilizing a 3-layer architecture (Flutter UI policy manager → Kotlin JNI hardware metrics reader → sandboxed C++ WAMR WASM runtime).
❯
cat end-to-end_execution_flow
mermaid
Data flow from code submission and compilation to edge distribution and streamed telemetry.
loading diagram
❯
cat 3-layer_consumer_edge_node_architecture
mermaid
Detailed execution pipeline across mobile Dart, Kotlin JNI, and C++ WAMR layers.
loading diagram
❯
less security_&_threat_model.md
md

MILF operates on a Zero-Trust security architecture for executing untrusted WASM binaries on edge hardware:

  1. User Identity: JWT & Google OAuth 2.0 developer verification.
  2. Admission Controller: Rejects jobs if device battery is low or thermal limits are exceeded.
  3. Bytecode Validation: WAMR verifies module structure before loading into memory.
  4. Memory Caps: Enforces strict allocation ceilings (512MB heap / 16MB stack) to block memory exhaustion attacks.
  5. Process Isolation: Runs in Android isolatedProcess sandbox with unique UIDs and zero permissions.
  6. Syscall Whitelisting: Kernel Seccomp filters restrict accessible system calls.