Why each android application runs on a different Dalvik VM process? I have read that each android applications runs on a different Dalvik VM process (all forked from zygote).

I also read that these VMs are really lightweight and use copy on write buffers and all that, so far so good.

But, I also read that this was not done for security reasons (e.g. isolation) - in fact dalvik vm should not be considered a security boundary, says Google.

So my question is this: Why each process has to run on a different VM?
In Android, every application runs as a separate user. In the Linux kernel, each process is owned by a single user, therefore it is not possible to run multiple Dalvik applications on a single Linux process.

The overhead of running multiple Dalvik VM instance is lightweight because Linux fork() system call is copy-on-write, a write to a shared COW page will cause a "page fault" and that page will be copied; so even though most of the VM's memory region in the RAM is shared there are no "shared state" between VMs.

Forking processes provides only state isolation, but not privilege isolation.


  dalvik vm should not be considered a security boundary


That is because the VM cannot enforce a security boundary. The VM is running on user mode (the same mode as the program it's executing), which means a bug in the VM might allow the application to modify VM state in a way that is not intended; the kernel, however, runs in privileged mode and can enforce security boundary.