OSS + ELC EU 2026

Microcontroller firmware is monolithic: one image, one failure domain, where a bug anywhere can crash everything. Yet modern MCUs ship with memory protection (MPU, MMU, or PMP), and Zephyr already has the isolation pieces - userspace, memory domains, kernel-object capabilities, watchdogs, zbus - never assembled into an application model.

This talk presents a service-oriented application layer for Zephyr: multiple memory-isolated apps running as managed units, each reaching hardware and the network only through a capability-gated service broker, so a misbehaving app cannot corrupt, starve, or crash its neighbors.

We build the missing keystone - an app-group lifecycle and a service broker - on top of existing Zephyr, and demonstrate it live: two isolated apps share one Wi-Fi stack, each making independent network requests; one hangs and another faults, both are killed and reclaimed, while the healthy app runs on. We close with hardware lessons and upstreamable RFC targets.