  This paper presents the "isolate first, then share" OS model in which the
processor cores, memory, and devices are divided up between disparate OS
instances and a new abstraction, subOS, is proposed to encapsulate an OS
instance that can be created, destroyed, and resized on-the-fly. The intuition
is that this avoids shared kernel states between applications, which in turn
reduces performance loss caused by contention. We decompose the OS into the
supervisor and several subOSes running at the same privilege level: a subOS
directly manages physical resources, while the supervisor can create, destroy,
resize a subOS on-the-fly. The supervisor and subOSes have few state sharing,
but fast inter-subOS communication mechanisms are provided on demand.
  We present the first implementation, RainForest, which supports unmodified
Linux binaries. Our comprehensive evaluation shows RainForest outperforms Linux
with four different kernels, LXC, and Xen in terms of worst-case and average
performance most of time when running a large number of benchmarks. The source
code is available soon.
