PDF
version of this report
You must have Adobe Acrobat reader to view, save, or print PDF files.
The reader is available for free
download.

Serverless Computing

by Geoff Keston

Copyright 2020, Faulkner Information
Services. All Rights Reserved.

Docid: 00021093

Publication Date: 2002

Report Type: TUTORIAL

Preview

A new type of cloud hosting, serverless computing, is letting
application developers save money and offload some responsibilities.
But realizing these benefits takes planning – writing code must be
thought of somewhat differently, and some interconnected processes need
to be modified. Making these changes requires understanding what
serverless offers, how it differs from similar cloud software hosting
models, and what management responsibilities still fall onto a
customer’s shoulders.

Report Contents:

• Executive Summary
• Description
• Current View
• Outlook
• Recommendations
• References
• Web Links
• Related
  Reports

Executive Summary

[return to top
of this report]

Serverless computing is a way to host software code on a cloud
service with less expense and fewer management concerns.

Small “functions” are uploaded by a customer, who doesn’t need to
understand the underlying infrastructure.
Customers are charged only for the time that functions run (sometimes
with a few additional charges), and because the provider maintains a
large, sophisticated datacenter, capacity can scale up quickly,
automatically, and to almost any level.

These
are important benefits, but there are limitations too. Only small
chunks of
code can be hosted in this way, so other cloud services are
still needed for larger software bundles and full applications. And the
services are not as “hands off” or “worry free” as sometimes depicted.
Some decisions about the hosting logistics still fall to the customer,
and developing code that is suitable for serverless hosting takes
careful consideration of interconnected software development
issues. Another concern for customers is security. Overall,
serverless is
likely a benefit to security because there is less to attack (functions
are small and executed only for a brief time), but all security threats
may not be
fully understood.

These services are already in wide use, as they developed
naturally
from other types of cloud hosting. The market hasn’t been shaken, but
instead well-known cloud providers have added serverless computing to
their
existing portfolios. As such, cloud computing’s top provider, Amazon,
leads the serverless field, and other major cloud players like Google
and Microsoft have strong footholds in the market. But some smaller
companies have established strong positions, including Alibaba and
Pivotal, which is now owned by VMware. Other leaders include Apache,
IBM, and Oracle

Taking advantage of these services demands some consideration
of an
organization’s overall approach to software development and IT. The
shift to serverless is not necessarily greatly disruptive, and only
certain types of code hosting needs are affected. But some changes to
development processes are likely necessary to create code that can work
on
a serverless platform.

Description

[return to top of this report]

Serverless
computing is an emerging architecture for hosting code on the cloud.
Instead of uploading an entire application, developers submit code that
performs a limited function. This approach offers three main benefits:

• Less Management — In traditional,
  on-site networking, an
  organization needs to set up and manage the servers on which its code
  runs. In older versions of cloud services, the hosting provider assumes
  some of
  the responsibilities for the implementation and daily management of
  servers, but customer organizations handle some of this work as well.
  In serverless, however, the daily management and monitoring are
  entirely handled by the provider and most or all of the initial service
  provisioning is handled by the provider as well.¹
• Automatic (Nearly Limitless) Scalability
  — Another
  characteristic of traditional software hosting is that
  capacity must be planned in advanced. Developers and administrators
  need to predict maximum traffic volumes and then ensure that
  that amount of capacity is available as needed. With serverless
  computing, a
  theoretically limitless amount of capacity is provided instantly, as
  needed, without the software developer needing to predict usage. This
  allows functions to handle demand spikes as needed and also to
  grow in usage over time.
• Lower Costs — The lower cost of
  serverless computing is a
  result of the fact
  that customers only pay when a function is running, not when
  it is
  idle. (In traditional hosting services, by contrast, customer
  organizations pay for idle storage, perhaps monthly.) In serverless
  computing, a function is triggered by a person’s action (or the action
  of another piece of connected software), and customers are charged only
  for short time the function runs. For example, AWS Lambda costs just 20
  cents for 1 million requests. But there are some additional charges,
  such as approximately $3.50 for every one million API calls and
  additional charges for data moving into and out of the function.² Google’s
  pricing structure is similar. Customers pay nothing for the
  first 2 million executions of a function, then pay 40 cents per million
  afterward, with some additional fees based on “how long your function
  runs, how many times it’s invoked
  and how many resources you provision for the function. If your function
  makes an outbound network request, there are also additional data
  transfer fees.”³

Unless triggered by an event, functions are idle (or “stateless”). Many
different types of events can trigger a function, including the
following:

• A user’s action (such as requesting data or uploading
  content)
• A connection initiated by another piece of software
• A change in status by an Internet of Things device
• Scheduled events

Serverless computing is not useful for all types of cloud
hosting or software,
however. There are fairly strict size limits on the code that can be
uploaded. For example, AWS Lambda has the following limits:⁴

• 250 MB of data without compression
• A run-time of five minutes or less
• The need for no more than 512MB of “ephemeral storage”

An example of why an organization would choose serverless
computing
over traditional cloud hosting comes from FUJIFILM.⁵
By 2016, the
company’s IMAGE WORKS service had been operating for 10 years, and the
technology underlying it was mostly based on a legacy infrastructure
that was difficult to support and that made adding features a
challenge. Instead of building out its own datacenter, the company
decided that a serverless hosting service would cost less, improve
security, and enable new features to
be more quickly added. As part of the change, FUJIFILM also switched
its
development methodology from waterfall to Agile.

Current View

[return to top
of this report]

Serverless computing is still somewhat new, but it is already widely
established. This quick emergence reflects the fact that many
of the key
elements of the service were already in place. Hosting
software in small units has been popular and widely performed for many
years in slightly different forms. Serverless computing’s emergence is
therefore more evolution
than revolution. Most of the leading serverless platforms are offered
by
companies that have years of experience providing cloud hosting and
developing online applications, although some smaller specialty companies hold significant market positions:⁶

• Apache
• Alibaba Cloud
• Amazon Web Services (AWS)
• Google 
• IBM 
• Microsoft 
• Oracle
• Pivotal (acquired by VMware)

The existence of mature hosting services with many supporting features
enables providers to offer serverless computing customers the
following:

• An interface for uploading code
• The connection of disparate APIs and applications
• Querying
• Analytics
• Monitoring and logging
• Advanced capabilities like sentiment detection and speech
  recognition

While serverless computing is in wide use and there are well-developed
platforms available, the ways that the concept can be employed are
still being
explored.⁷ Also, developers of popular
commercial software products are in the process of redeveloping aspects
of their software to work with a serverless architecture.⁸

Outlook

[return to top
of this report]

The
use of serverless architectures is likely to grow, but the scale and
consistency of this growth are difficult to measure. An O’Reilly
survey found that 40 percent of organizations were using serverless
architectures for some functions, with approximately half of those who
have used the technology for at least three years saying that their
usage was beneficial. But organizations that have used the technology
for less time were not as likely to tout its benefits, and those that
haven’t implemented it saying that they have concerns about security
and other issues.⁹ But other assessments have spotted
potential signs of a dip in enthusiasm for serverless architecture. A
2019 Cloud Foundry survey found that 15 percent of organizations were
using serverless, down slightly from 19 percent the year before.¹⁰ The
differences between the results of these surveys shows the difficulty of
measuring the use of serverless technology, which is typically a
characteristic of cloud services, often not labeled as a distinct type
of architecture.

Serverless computing doesn’t appear likely to dramatically
change the
cloud marketplace. The serverless market’s dynamics are relatively similar to those of the
cloud hosting market because serverless computing has not developed from
new innovations, so there is little room for specialty companies with
new or unique hosting features to emerge. Most customers will find it
easier to use the same host for
serverless work as for other hosting needs, and most will choose hosts
that have characteristics of large, established providers, such as
being
reliable and secure.

But there does appear to be room, potentially, for new, specialty
serverless security companies, such as the following:

• Aqua Security
• PureSec
• Twistlock

Overall, there are
security benefits and drawbacks to this new software hosting
architecture. Advantages include that functions are small in size and
that the virtual server instances to run them last for only the brief
duration a function is executing. These characteristics give hackers
less to attack. But the serverless model is also new, so organizations
may not understand how to protect their code, giving
hackers an opening. The near-term future of serverless computing will
be determined in part by what is learned about these security issues
and
how they are addressed.

Early on, uncertainty about serverless hosting spawned security
concerns. But more recently, documentation and best practices have been
established, helping to bolster confidence in the technology.¹¹

Other details
of the technology are still being worked out too, and customer
preferences
and complaints will help to direct development over the next few years.
“Certain
drawbacks to Serverless [function-as-a-service] right now come down to the way platforms
are implemented,” says Mike Roberts of cloud-focused consulting firm
Symphonia.¹² “Execution duration, startup
latency, and
cross-function limits are three obvious ones. These will likely either
be fixed by new solutions or given workarounds with possible extra
costs.”

Roberts recommends that these issues can often be addressed by
IT staffs learning about this new architecture and its
impact: “Everyone using such platforms needs to think
actively about what it means to have so much of their ecosystems hosted
by one or many application vendors.”

Recommendations

[return to top
of this report]

Evaluate all Cloud Goals and Technologies

Serverless computing is similar to, and overlaps with, many other cloud
services for hosting software. Similar models include
platform-as-a-service, containers, cloud native
computing, microservices, and function-as-a-service. (The term
“function-as-a-service” is often synonymous with serverless
computing.) These terms are defined somewhat differently
across the industry, so customer organizations need to understand
precisely what each provider is offering. And the meanings of these
terms will likely evolve in the coming years, so monitoring this
evolution will also be important for customers. IBM recommends
distinguishing such services according to the size of the software
being hosted (e.g., a small function vs. an entire application), the
resources that customers must pay for, the customer’s implementation
responsibilities, the time to launch the hosted software, the
administration required, and the scaling capabilities, among
other criteria.¹³ For example, by IBM’s
definition, function-as-a-service doesn’t ask
customers to consider memory or CPU requirements, but
platform-as-a-service charges customers based on their use of these
resources.

Other providers and industry observers may define these terms
differently from IBM, but this framework for understanding the
differences between the services is useful.

Determine When to Use Serverless (and When not to Use It)

Serverless hosting is suitable only for some purposes, so organizations
need to consider their business and technology needs on a case-by-case
basis. “There is a trade-off to adopting the serverless, service-full
philosophy,” says Zack Kanter of EDI company Stedi.¹⁴
“Building a radically serverless application requires taking
an enormous hit to short term development velocity, since it is often
much, much quicker to build a ‘service’ than it is to use one of AWS’s
off-the-shelf.”

A common viewpoint is that serverless is not a good approach to applications with
significant performance demands.¹⁵
Such concerns should drive organizations to monitor the performance of
their applications rather than relying on the software host.¹⁶
Another concern is that using serverless heavily commits a customer to
a particular host, because their applications become tailored to the
service provider’s infrastructure.¹⁷ Organizations that need flexibility or have certain privacy requirements may not be able to use serverless.

Finally,
circumstances in which low cost is crucial are especially conducive to
serverless hosting, which only charges customers when code executes.¹⁸ Therefore, it will also typically be used for lower priority hosting.

Consider DevOps and Agile Goals

DevOps and Agile are two, compatible, models for software
development.
DevOps links the development team’s processes with those of IT
operations, and Agile focuses on building software in smaller pieces
and shorter intervals. Such approaches share some of the core values
and concerns of serverless computing.¹⁹

Another way to look at the connection to models such as DevOps
and Agile is that serverless computing is not simply a service that can be
bought and used. Instead, its use must be planned for in terms of what
type of code will be produced, what processes will be used to produce
it, and how it will connect to the rest of an organization’s coding,
IT,
and business processes.

References

[return to top
of this report]

¹ Bret McGowen. “Serverless
Computing Options with Google Cloud Platform.” Proceedings
of Google Cloud Next.
2017.

² Jagatveer Singh. “The Cost
of Serverless.” Medium.
September 26, 2018.

³ “Cloud Functions:
Pricing.” Google.

⁴ Bernard Golden. “Serverless
Computing: Five Things to Know about
the Post-Container World.” TechBeacon.

⁵ “Which Cloud Helps FujiFilm Cut
Latency by 95 Percent for a
Superb Customer Experience?” FujiFilm. July 17, 2017.

⁶ This list was compiled in part by referencing the following:

⁷ Arun Chandrasekaran and
Craig Lowery. “An I&O Leader’s Guide to Serverless Computing.” Gartner.
April 26,
2018.

⁸ “What Is Serverless
Architecture and Why Does It Matter
to Your Business: Interview
with Jeffrey Hammond of Forrester
Research. TechRepublic. November 14, 2017.

⁹ Roger Magoulas and Chris Guzikowski. “O’Reilly Serverless Survey
2019: Concerns, What Works, and What to Expect.” O’Reilly. November 12,
2019.

¹⁰ Joe McKendrick. “Serverless Computing Growth Softens, at Least for Now.” ZDNet. April 25, 2019.

¹¹ Ory Segal. “The 12 Worst Serverless Security Risks.” Dark Reading. March 12, 2019.

¹² Mike Roberts. “Serverless
Architectures.” MartinFowler.com.
May 22,
2018.

¹³ “Function as a Service
Compared.” IBM. January 29, 2019.

¹⁴ Zack Kanter. “The Business
Case for Serverless.” TechCrunch.
December 15, 2018.

¹⁵ Melanie Wolkoff. “Serverless Computing: 6 Things You Need to Know.” TechRepublic. March 26, 2019.

¹⁶ Kaya Ismail. “When and Why You Should Go
with a Serverless Architecture.” CMSWire. July 9, 2019.

¹⁷ See:

¹⁸ See:

¹⁹ For example, see:

Web Links

[return to top
of this report]

Alibaba Cloud: https://alibabacloud.com/
Apache OpenWhisk: https://openwhisk.apache.org/
AWS Lambda: https://aws.amazon.com/lambda/
Cloud Native Computing Foundation: https://www.cncf.io/
Google Cloud Functions: https://cloud.google.com/functions/
IBM
BlueMix Cloud Functions: https://console.bluemix.net/openwhisk/
Microsoft Azure Functions: https://azure.microsoft.com/en-us/services/functions/
Oracle: http://www.oracle.com/
Pivotal: https://pivotal.io/
VMware: https://www.vmware.com/

About the Author

[return to top of this report]

Geoff Keston is the
author of more than 250 articles that help organizations find
opportunities in business trends and technology. He also works directly
with clients to develop communications strategies that improve
processes and customer relationships. Mr. Keston has worked as a
project manager for a major technology consulting and services company
and is a Microsoft Certified Systems Engineer and a Certified Novell
Administrator.

[return to top of this report]