The thing I don't get: We'll now run those N unikernel things in VMs with a hypervisor underneath. How is that different from running static binaries in a locked-down OS, i.e., with a traditional kernel? You can surely break out of a unikernel by "popping the kvm" as the article mentions. How is that more secure? In principle we are running the same things, just call them differently (app becomes unikernel+app, kernel becomes hypervisor).
replyBoth have weaknesses, but with an OS, you have certain bottlenecks - like your app memory is paged and has its own memory space, data structures are often duplicated in user and kernel memory, syscalls have cost, which is why io_uring is a thing in Linux.
replyThis is all unnecessary overhead and complexity, as the OS doesn't really mediate hardware access in this case.
But you're right on some points, it's not really more secure, but there's a hell of a lot less complexity where things can go wrong.
It's conceptually equivalent but the details differ. The program has access to more abilities and in terms of common conventions the security boundary is much more robust. If nothing else I'd argue it's a superior abstraction with which to make the delineation.
reply