Trusted Open-Source Libraries as Microservices

Open-Source Popular Libraries from Trusted Vendors becoming
Isolated, Access-Controlled, Plug-and-Play Microservices,
with automated lifecycle, and compliance workflow.

Microservice Store is starting an open-source engineering initiative to convert commonly used embedded libraries from Trustworthy Vendors and Technology Leaders, such as cryptography libraries, communication stacks, and file systems, into

⭐ Isolated
⭐ Access-Controlled
⭐ Individually Deployable
⭐ Plug And Play

embedded Microservices that could be downloaded from the Microservice Store, an App Store for IoT Devices, with a single click.

"The objective is to provide engineers with reusable components that can be deployed and maintained as independent units, rather than being repeatedly integrated into source code within monolithic firmware images."

For engineering directors and teams, this is about reducing integration cost, lowering update risk, and improving operational control across device fleets. A library delivered as a Microservice becomes a deployable component with explicit permissions, independent upgrades, and clear ownership boundaries, backed by an automated supply chain that can distribute updates, detect failures, and generate compliance-ready software evidence.

✨ Lower Operational Risk, Targeted Changes Only

Instead of changing a single library and inadvertently affecting the entire firmware, you can upgrade only the Microservice that changed. This reduces regression scope, lowers bandwidth, and makes field updates more predictable for long-lived fleets.

✨ Clear, Actionable Failure Reporting

If a Microservice malfunctions or violates its access policy, the runtime produces structured fault evidence, and Microservice Store notifies both the Library developer and the product vendors using it. Reports can include low-level execution context such as Program Counter (PC) and Stack Content, enabling faster root-cause analysis and a shorter path to a fix.

✨ Better Fault Containment &
Service Continuity

Libraries embedded inside monolithic images share the same failure domain. By delivering libraries as isolated Microservices, faults and policy violations can be contained to a single execution unit, protecting the rest of the system and supporting service continuity.

✨ Faster Remediation Through Automated Updates

When a library ships a security fix or improvement, the traditional approach often forces a full firmware rebuild, retest, and redeploy cycle, then you still need to figure out which products are affected. With library-as-a-microservice, updates are delivered as component releases. Microservice Store can orchestrate rollout policies and automatically upgrade devices that use the affected Microservice, reducing manual effort and shortening patch timelines.

✨ EU CRA, UK PSTI Compliance-ready SBOM and Vulnerabilirty Reporting

Modern legislation expects software transparency and fast response. Microservice Store supports Microservice-level software inventory and SBOM-aligned outputs, enabling legislation bodies to track exactly which library versions are deployed where. For regimes such as the EU Cyber Resilience Act (CRA), which includes SBOM and vulnerability reporting expectations, the platform is designed to support library, microservice-level SBOM generation and structured vulnerability reporting workflows, handling compliance overhead and improving audit readiness.

Microservice Store-Maintained Proxy Vendor Accounts
and Clear attribution

To publish these Microservices early and transparently, we use Store-Maintained accounts operated by Microservice Store.

Microservices published through this initiative will be labelled as: “Proxy: by Microservice Store”. This makes maintenance responsibility explicit while keeping the origin discoverable, without implying the vendor published it directly (yet).

Library Vendor Takeover Path (when they want it)

The Store-Maintained model is designed as a handover-friendly bridge. If library vendors/developers decide to publish and maintain these MicroServices directly, we transfer ownership so the components become officially maintained under their control, including release cadence and support model.

What we are prioritising first

We will begin with libraries that are widely reused and operationally sensitive:

Cryptography libraries and crypto service layers
Communication stacks and secure connectivity components
File systems and storage components
Common protocol and data-handling components used across products

Please see the ongoing efforts that transform open-source libraries into Microservices.

🔗 https://github.com/MicroserviceStore-OpenSource