In many applications, the ability to dynamically load and execute third-party code (in the form of plug-ins) is highly desirable. Plug-ins can be used to provide:
- Alternative implementations of built-in features
- Completely new features (given some kind of framework on which they can be built)
- All functionality in the application (e.g. in a test harness, compiler or other modular system)
There are a number of mechanisms within the .NET Framework to facilitate plug-in code:
Reflection enables assemblies to be dynamically loaded (removing compile-time references), and to iterate through the types in an assembly. To build a plug-in system based entirely on reflection, however, would be limiting, unreliable and very slow. The overheads involved in calling methods via reflection are high. Also, in the absence of a compile-time reference to an object, you lack the ability to verify whether the object contains the method/property you’re trying to access.
Interfaces are one of the key primitives in object orientated programming. They allow you to define the public methods, events and properties of a type without specifying how it should be implemented; or indeed, how it should behave. You can toss around a reference to an object using only its interface type, and still be able to do everything with the object that you could do with a concrete class (save for instantiating it, of course).
An obvious way to implement a plug-in system, therefore, would be to define a set of interfaces that were common to both the application and its plug-ins, implement them in the plug-ins and load them into the application using reflection. The advantage of this approach is that you have a contract at compile-time against which you can guarantee that the methods/properties you’re accessing exist on the object you’ve loaded.
There is quite a significant downside to this approach, however: You are loading third-party, potentially malicious code directly into your application’s memory space. The plug-in code could use reflection to access and manipulate everything in your application, not to mention crash it. It’s not hard to see why this would be a bad idea.
Application domains are an important (though perhaps not widely-understood) part of the .NET Framework. The vast majority of applications will only ever use a single AppDomain but, when utilised, they can be very powerful. Application domains sit at a high level in the runtime, providing a memory space into which the code you reference and execute is loaded. The only way to access managed objects from outside their AppDomain is to serialise them (a process over which you can exercise a lot of control) or to marshal them via remoting. An AppDomain can be secured to prevent another AppDomain from seeing inside it, loading assemblies and reflecting types. It can also raise and handle its own exceptions, keeping it isolated from the main process. This is definitely a solid foundation for a plug-in system.
It makes a lot of sense to load any plug-in code into a separate AppDomain, then ferry objects between the two domains in a controlled, sandboxed fashion. A general rule to consider when writing plug-in code is:
- Use binary serialisation (the Serializable attribute or the ISerializable interface) when passing data between two application domains. Only ever pass an instance of a type that is common to both domains; e.g. a standard .NET type or a type defined in an assembly that is referenced by both domains. Any operations performed on serialisable types will run in the AppDomain that calls them (i.e. the main application).
- Use remoting (handled transparently by MarshalByRefObject) when calling methods or raising events. Operations performed on remotable types will run in the AppDomain in which they are instantiated (i.e. the plug-in domain).
Why Not WCF?
At this point, you might well ask, “Why not use WCF as the basis for a plug-in system?”. It’s true, some developers do advocate this practice, but I personally do not. WCF imposes a number of show-stopping limitations on plug-in code:
- WCF handles events poorly, requiring callback interfaces to be manually defined and wired up. Remoting handles events transparently.
- Operations on WCF services can only exchange serialisable data. You can’t, for example, pass a remotable object to a WCF service to enable two-way communication.
- WCF is primarily designed to be stateless. Plug-in code is almost always stateful. Although WCF handles sessions and concurrency, these can be difficult to use.
- WCF uses XML serialisation based on public members of a type. Remoting uses binary serialisation and has the necessary permissions to access private members of a type.
- WCF is optimised for interprocess and network-based communication, not communication between two application domains within the same process.
And, of course, it’s worthwhile to note that WCF itself is built on top of .NET Remoting; it is under no threat of deprecation, as it is a fundamental part of the framework.
More About MarshalByRefObject and Remoting
MarshalByRefObject is essential to any non-trivial cross-AppDomain functionality. It is handled specially by the .NET Framework; all you have to do is inherit from MarshalByRefObject and the framework will generate a transparent proxy for your class, automatically marshalling calls between the application domains for you.
Some important things to remember about writing classes that extend MarshalByRefObject:
- Any objects you pass-to or return-from a MarshalByRefObject must be serialisable, or themselves a MarshalByRefObject.
- You must remember to mark any types you derive from Exception or EventArgs with the [Serializable] attribute.
- IEnumerable sequences created using the yield statement or LINQ cannot cross an application domain (because the compiler does not mark them as serialisable). Don’t return sequences from a MarshalByRefObject; instead, copy the elements into a collection (or use the ToList() method) and return the collection.
- If you pass a delegate to a MarshalByRefObject – and the method it points to is in a different AppDomain – you must ensure that the method belongs to a MarshalByRefObject as well. Do not pass delegates to static methods, because they will be called on the wrong AppDomain (since there is no object instance to marshal the call to).
There are some other common types that can’t cross application domain boundaries:
- DataObject (used for drag-and-drop, clipboard and other OLE functionality) is neither MarshalByRefObject or serialisable. You can either extract the data and pass it directly to the other AppDomain, or create a wrapper that implements IDataObject and inherits from MarshalByRefObject.
- Image/Bitmap, although marked as serialisable, may not cross AppDomain boundaries. You should pass a Stream or byte[] containing the image data instead.
Lifetime Services and ISponsor
To further complicate matters, remoting uses lifetime services (rather than ordinary generational garbage collection) to determine when instances of a MarshalByRefObject should be cleaned up. By default, you have a window of 5 minutes in which to use an object obtained from a foreign AppDomain before the proxy becomes disconnected and an exception is thrown upon access. This is a necessary evil, because the garbage collector can’t count references to a remotable object inside a different application domain; that would break the isolation provided by application domains in the first place.
There are two methods to get around this, however:
- Override the InitializeLifetimeService() method and return a null reference. This instructs remoting not to clean up instances of your object in another AppDomain. This has the potential to create memory leaks, so you can really only use this technique for singleton classes.
- Obtain the lifetime service object (ILease) from the MarshalByRefObject using the RemotingServices class and register an ISponsor object to keep the instance alive.
Sponsorship works by renewing the lease on a MarshalByRefObject; it does this by returning a TimeSpan indicating how much longer the object is needed. Remoting will periodically call the Renewal() method on an ISponsor object until it returns a timespan of zero, or the sponsor is unregistered.
// register a sponsor
object lifetimeService = RemotingServices.GetLifetimeService(myMarshalByRefObject);
if (lifetimeService is ILease) {
ILease lease = (ILease)lifetimeService;
lease.Register(mySponsor);
}
// unregister a sponsor
object lifetimeService = RemotingServices.GetLifetimeService(myMarshalByRefObject);
if (lifetimeService is ILease) {
ILease lease = (ILease)lifetimeService;
lease.Unregister(mySponsor);
}
In practice, what this means is that you should hold a reference to a sponsor for any MarshalByRefObject you obtain from another AppDomain for as long as you need to access the object. When the sponsor object becomes eligible for garbage collection, it will also take out the remotable object which it sponsors. Ideally, implementations of ISponsor should be serialisable.
In my implementation of a plug-in system, I created a convenient generic class, Sponsor<TInterface>, which is simultaneously responsible for registering/unregistering a sponsor, accessing the remotable object itself and providing the renewal logic. You hold a reference to the sponsor object in your class, then call its Dispose() method when the remotable object is no longer needed. My plug-in system centers around the Sponsor class; ensuring that objects from the plug-in AppDomain are always wrapped in a Sponsor instance and never returned directly to user code without one.
Design for a Plug-In System

As I have alluded to, a plug-in system based on reflection, interfaces, remoting and sponsors is built around two application domains. The main AppDomain uses the PluginHost class to create the plug-in AppDomain and remotely instantiate PluginLoader, the class that loads plug-ins and instantiates remotable objects:
// create another AppDomain for loading the plug-ins
AppDomainSetup setup = new AppDomainSetup();
setup.ApplicationBase = Path.GetDirectoryName(typeof(PluginHost).Assembly.Location);
// plug-ins are isolated on the file system as well as the AppDomain
setup.PrivateBinPath = @"%PATH_TO_BINARIES%\Plugins";
setup.DisallowApplicationBaseProbing = false;
setup.DisallowBindingRedirects = false;
AppDomain domain = AppDomain.CreateDomain("Plugin AppDomain", null, setup);
// instantiate PluginLoader in the other AppDomain
PluginLoader loader = (PluginLoader)domain.CreateInstanceAndUnwrap(
typeof(PluginLoader).Assembly.FullName,
typeof(PluginLoader).FullName
);
// since Sandbox was loaded from another AppDomain, we must sponsor
// it for as long as we need it
Sponsor<PluginLoader> sponsor = new Sponsor<PluginLoader>(loader);
PluginLoader dynamically loads the plug-in assemblies (located in a subdirectory) into the plug-in AppDomain:
foreach (string dllFile in Directory.GetFiles(pluginPath, "*.dll")) {
Assembly asm = Assembly.LoadFile(dllFile);
Assemblies.Add(asm);
}
PluginLoader keeps a cache of ConstructorInfo objects for each interface implementation it discovers, so it can quickly instantiate objects. It exposes GetImplementations (returns IEnumerable<TInterface>) and GetImplementation (returns the first implementation of TInterface).
private IEnumerable<ConstructorInfo> GetConstructors<TInterface>() {
if (ConstructorCache.ContainsKey(typeof(TInterface))) {
return ConstructorCache[typeof(TInterface)];
}
else {
LinkedList<ConstructorInfo> constructors = new LinkedList<ConstructorInfo>();
foreach (Assembly asm in Assemblies) {
foreach (Type type in asm.GetTypes()) {
if (type.IsClass && !type.IsAbstract) {
if (type.GetInterfaces().Contains(typeof(TInterface))) {
ConstructorInfo constructor = type.GetConstructor(Type.EmptyTypes);
constructors.AddLast(constructor);
}
}
}
}
ConstructorCache[typeof(TInterface)] = constructors;
return constructors;
}
}
private TInterface CreateInstance<TInterface>(ConstructorInfo constructor) {
return (TInterface)constructor.Invoke(null);
}
public IEnumerable<TInterface> GetImplementations<TInterface>() {
LinkedList<TInterface> instances = new LinkedList<TInterface>();
foreach (ConstructorInfo constructor in GetConstructors<TInterface>()) {
instances.AddLast(CreateInstance<TInterface>(constructor));
}
return instances;
}
PluginHost calls the GetImplementation/GetImplementations methods on PluginLoader to return transparent proxies to the remotable objects instantiated from the plug-ins. It wraps them in a Sponsor instance and returns them to the user. PluginHost also handles reloading/unloading of the AppDomain.
Putting It All Together
The general usage pattern for my plug-in system would be:
- Create a series of interfaces and place them in a common assembly.
- Create one or more plug-in assemblies containing types that implement the interfaces.
- Create an application which references only the common assembly.
- Instantiate PluginHost, passing the path to load plug-ins from.
- Call the LoadPlugins() method and check for success.
- Instantiate implementations of the plug-in interfaces using the GetImplementations() or GetImplementation() methods.
- Keep a reference to the Sponsor<TInterface> object returned from the above methods until the object is no longer required.
- Unload the plug-in AppDomain by calling Dispose() on the PluginHost object.
You can see an example of this in the included example project.
Final Words
Nobody can deny that loading third-party code in a separate application domain is regarded as best practice. Hopefully, this task is greatly simplified through the use of the plug-in system i’ve provided. It is, of course, simply a proof of concept implementation. Other things you might want to consider would be:
- Applying security to the plug-in AppDomain to further sandbox the environment.
- Filtering the plug-in assemblies loaded; either according to digital signatures, implementation of marker interfaces or particular metadata.
- Making metadata about the plug-ins available to calling code.
- Handling exceptions more gracefully.
In any event, I hope it demonstrates the basic idea behind cross-AppDomain programming in .NET.
Download
PluginSystem.zip (Visual Studio 2010 solution, zipped)