Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is a 'unikernel'?

ma.ttias.be

Post reply on HN
Print view View original

21–30 of 71 posts

Re: What is a 'unikernel'?

#21

Post by amirmc »

kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

Depends on where you imagine the work to be.

I tend to think of unikernels as having to 'front-load' more of the work. That's why you can treat the end artefact as almost disposable.

With a traditional stack, it may be easier to set up, but you're then committing to acting as caretaker for the code that runs on that machine, inc. patches, upgrades, version constraints, etc. There's probably more work there over the long term.

This is kind of where the distinction of 'cattle vs pets' comes from.

Re: What is a 'unikernel'?

#22

Post by justincormack »

dschatz wrote: post #9

1) How does a unikernel differ from a library OS? Is a unikernel a kind of library OS? 2) Is the specialization the important aspect? I see OSv referred to as a unikernel but it does no specialization, it supports almost the entire Linux ABI. I'd argue it is a library OS, though.

Yes I think 1. is true, it is a library OS and your application, but very much in the library OS model.

OSv is a bit unusual architecturally, it is almost a very small OS that runs applications in a single address space. It is perhaps a hybrid architecture.

Re: What is a 'unikernel'?

#23

Post by amirmc »

crb wrote: post #11
kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

My simplified version: A container is a way of sharing the resources of a kernel, with some resource isolation. A unikernel is a way of sharing the resources of a hypervisor. There are pros and cons to each: a container lets you run other things on the same kernel, and introspect the running process (as well as do interception of things like sysdig does.) However, root-on-container generally means root-on-all-contain…

> "You lose some of the convenience of management of containers in order to get this."

Not necessarily... http://unikernel.org/blog/2015/unikernels-meet-docker/

Re: What is a 'unikernel'?

#24

Post by alextgordon »

mahyarm wrote: post #13
alextgordon wrote: post #8

Earlier quoted context omitted.

I don't think containers are related to unikernels. The whole point of containers is to sacrifice a bit of performance in order to gain convenience. Whereas for unikernels, it's the opposite > Unikernels leverage the advantages of virtualisation to create an operating system that's as specialised and optimised as possible. It makes no sense to craft a hyper efficient kernel and then run Ruby on it. If your requiremen…

Or if you want to remove a potential layer of security issues.

I am exceptionally sceptical that "specialised" and "secure" are anything but opposites.

"One hundred novel implementations of /dev/random" is a security nightmare. What you want is one implementation of /dev/random that everybody uses. Like uh, Linux.

Same goes for every other element of the kernel. A secure kernel does not come from using (I'm sorry to say) a hipster programming language, it comes from decades of abuse that is thrown at mainstream kernels.

Re: What is a 'unikernel'?

#25

Post by andrewstuart2 »

kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

You're very likely not alone, but this is just a symptom of an underlying truth that in engineering, there are always trade-offs. Even with fundamentals like sort algorithms or hash tables, the best implementations for general cases may not be the best choice for some individual cases (mostly-sorted inputs, for example).

Quicksort and universal hash tables use randomization to avoid problems that arise with pathological sets of data, and so their performance can only be given on average.

If even simple CS primitives have such trade offs, then those are certainly going to propagate up the complexity tree as we engineer solutions on top of them.

In general, it's probably best to just know that these things exist and what their strengths and weaknesses are (they will almost certainly always have both) so that you can pick the right tools for the job at hand.

Re: What is a 'unikernel'?

#26

Post by Hoff »

While the term unikernel is fairly recent,the basic concept goes back a long time.

One example of this general design is VAX ELN.

The following is a brochure from the V2.2 release, from 1986:

http://bitsavers.trailing-edge.com/pdf/dec/vax/vaxeln/2.0/VA...

Compile and then link the application code with the particular pieces of the toolkits that you needed and with the provided kernel into a single download image, and either embed or boot or network boot the target box using it. Remote debugging was available, as well as a relational database, etc.

Re: What is a 'unikernel'?

#27

Post by amirmc »

justincormack wrote: post #22
dschatz wrote: post #9

1) How does a unikernel differ from a library OS? Is a unikernel a kind of library OS? 2) Is the specialization the important aspect? I see OSv referred to as a unikernel but it does no specialization, it supports almost the entire Linux ABI. I'd argue it is a library OS, though.

Yes I think 1. is true, it is a library OS and your application, but very much in the library OS model. OSv is a bit unusual architecturally, it is almost a very small OS that runs applications in a single address space. It is perhaps a hybrid architecture.

I've described it by saying unikernels are constructed by library operating systems. ie, the unikernel is the artefact but the libOS is what you (as a dev) actually work with.

The first line of the Wikipedia page is written this way - https://en.wikipedia.org/wiki/Unikernel

Re: What is a 'unikernel'?

#29

Post by mahyarm »

alextgordon wrote: post #24
mahyarm wrote: post #13

Earlier quoted context omitted.

Or if you want to remove a potential layer of security issues.

I am exceptionally sceptical that "specialised" and "secure" are anything but opposites. "One hundred novel implementations of /dev/random" is a security nightmare. What you want is one implementation of /dev/random that everybody uses. Like uh, Linux. Same goes for every other element of the kernel. A secure kernel does not come from using (I'm sorry to say) a hipster programming language, it comes from decades of a…

It wouldn't be 100 implementations of /dev/random, but one implementation per language.

Security with a C / C++ based system that has to be everything to everyone is pretty much intractable. If you have a java unikernel server for example, you only have one programming language which you can understand from top to bottom with a lot of well written open source libraries.

Then you have a hypervisor, from what I understand can be far simpler than the linux kernel, POSIX and everything else. You only have two smaller layers to understand, versus the huge unix ecosystem stack to understand.

Also changing something inside your unikernel stack would be a git commit & deploy away. Patching a kernel vulnerability which you probably don't understand is a significantly longer undertaking.

Re: What is a 'unikernel'?

#30

Post by reilly3000 »

OSv looks really promising. Turns regular jvm bytecode into unikernals. If you are building immutable apps, why not deploy them with an immutable foundation as well? The HN hivemind has declared microservices bad for bootstrapping new apps, but I'm convinced an end to end immutable workflow could actually dramatically boost team wide productivity. Tomorrow is a snow day so I get to play with OSv and see if I'm right.
Post reply on HN