Viewing profile — avsm

Custom infrastructure; I use my site as a playground for various things over the years. It ran as the first MirageOS unikernel for many years, and recently it's been running on a z…

There's a full terminal implementation of Bonsai as well. I actually use it in my personal workflow these days to manage my contacts database! https://anil.recoil.org/notes/aoah-20…

Fun is, by far, the biggest reason I can identify why I work on some open source projects and not others these days! I think it was also true in the past, but to a lesser extent. D…

yep, I host two separate Tangled knots; one for my personal use and another for work at the Cambridge Computer Science department. Having large git repos on a server near me is gre…

I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same. They've now added a WSL-style virtu…

Nice work! Did you ever open any open source any of it? Looking at your OCaml wishlist from back in 2017, some stuff has improved and some is on its way: - Support for read-only Bi…

I must confess to also using agents to do most of my OxCaml annotations: https://github.com/avsm/ocaml-claude-marketplace/tree/main/p... There's not that much downside since the an…

Do you have a link to your talk? I'm also curious if you did any GHG measurements, or it was part of the control stack. We wrote the XenServer stack in OCaml back in 2004, and that…

Yeah; all the really dangerous extensions are gated behind flags. But there's still a very significant number of optimisations available by default that just work well. I've taken …

The TL;DR here ( https://ccsds.org/Pubs/350x9g2.pdf ) seems to be "AES GCM", but with lots of lots of legacy protocols due to older birds in the sky. DTLS or HTTP3 would seem to be…

The big win here is having a GC by default, with the ability to reduce heap allocations (via stack) just by adding in more typing annotations. Switching to OxCaml with exclave_ sta…

The elephant in the room here is that there are hundreds of millions of embedded devices that cannot be upgraded easily and will be running vulnerable binaries essentially forever.…

> If the write ups are any useful, it generally appears here or reddit and I often link back those discussions in the articles Totally agree, I do the same as well on my site; e.g.…

From another comment below, it's just a nice short title to convey that we're going back in time and not one to set your watch by. We first submitted the article to the CACM a whil…

It's not as easy; a block device has to be bootable and so usually bundles a kernel (large). And because the filesystem inside is opaque, you can't do layering like Docker does eas…

cool! What services have you shipped as unikernels? Docker doesn't have to be an alternative; it can help with the build/run pipeline for them too: https://www.youtube.com/watch?v=…

> but omission from the article stands out. (article author here) Apple containers are basically the same as how Docker for Mac works; I wrote about it here: https://anil.recoil.or…

> I don't think SLIRP was originally for palm pilots, given it was released two years before. That's a mistake indeed; "popularised by" might have been better. Before my beloved Pa…

And those lightweight VM base images are possible because Docker applied a downward pressure on OS base image sizes! Alpine Linux doesn't get enough credit for this; in addition to…

Those are global to the machine; generally not an issue and seccomp rules can filter out undesirable syscalls to other containers. But GPU kernel/userspace driver matching has been…

Thanks for the kind words! I've been prodding @justincormack to resurrect the single most fun OS unconference I've ever attended -- New Directions in Operating Systems (last held b…

We've given up on native Windows containers in OCaml after trying to use them for our CI builds for many years. See https://www.tunbury.org/2026/02/19/obuilder-hcs/ for our recent …

Docker broke out the build layer into a separate component called BuildKit (see HN discussion recently https://news.ycombinator.com/item?id=47166264 ). However, Dockerfiles are so …

An extremely random fact I noticed when writing the companion article [1] to this (an OCaml experience report): "Docker, Guix and NixOS (stable) all had their first releases during…