Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is a 'unikernel'?

ma.ttias.be

Post reply on HN
Print view View original

61–70 of 71 posts

Re: What is a 'unikernel'?

#61

Post by musha68k »

crb wrote: post #11
kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

My simplified version: A container is a way of sharing the resources of a kernel, with some resource isolation. A unikernel is a way of sharing the resources of a hypervisor. There are pros and cons to each: a container lets you run other things on the same kernel, and introspect the running process (as well as do interception of things like sysdig does.) However, root-on-container generally means root-on-all-contain…

Does the xen hypervisor offer same-page merging? I believe kvm as well as lxc/cgroups do, at least to some extent and in their own idiosyncratic ways.

From the point of view of a former sysadmin and current "private cloud" enthusiast that's a crucial question that likely leads to intricate discussions on security as well.

Re: What is a 'unikernel'?

#62

Post by fulafel »

woah wrote: post #6
kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

Seems pretty weird that we think it's normal to run a computer that simulates several physical computers, each running an operating system built for the mainframe in a 70s university CS department closet that then only ever runs one user and one application. You just think it's easier because you're used to it. I'm glad that this development is happening. In a few years when it's mature, we'll all have a saner setup…

University CS dept people in the 70s probably thought the same thing at the time, having witnessed IBM get into it in the late 60s.

Re: What is a 'unikernel'?

#63

Post by crb »

amirmc wrote: post #23
crb wrote: post #11

Earlier quoted context omitted.

My simplified version: A container is a way of sharing the resources of a kernel, with some resource isolation. A unikernel is a way of sharing the resources of a hypervisor. There are pros and cons to each: a container lets you run other things on the same kernel, and introspect the running process (as well as do interception of things like sysdig does.) However, root-on-container generally means root-on-all-contain…

> "You lose some of the convenience of management of containers in order to get this." Not necessarily... http://unikernel.org/blog/2015/unikernels-meet-docker/

You lose the ability to monitor by introspection: all you know is "this VM is using X CPU and X RAM", you can't look into what it's doing inside the VM. It's the same as a VM without an agent, today.

This can be considered a security win and a usability loss.

Re: What is a 'unikernel'?

#64

Post by daddykotex »

reilly3000 wrote: post #30

OSv looks really promising. Turns regular jvm bytecode into unikernals. If you are building immutable apps, why not deploy them with an immutable foundation as well? The HN hivemind has declared microservices bad for bootstrapping new apps, but I'm convinced an end to end immutable workflow could actually dramatically boost team wide productivity. Tomorrow is a snow day so I get to play with OSv and see if I'm right.

Could you describe what you mean by an 'immutable app'?

Thanks

Re: What is a 'unikernel'?

#65

Post by Hoff »

nickpsecurity wrote: post #44
Hoff wrote: post #26

While the term unikernel is fairly recent,the basic concept goes back a long time. One example of this general design is VAX ELN. The following is a brochure from the V2.2 release, from 1986: http://bitsavers.trailing-edge.com/pdf/dec/vax/vaxeln/2.0/VA... Compile and then link the application code with the particular pieces of the toolkits that you needed and with the provided kernel into a single download image, and…

Not just another that knows of VMS and the prior innovations but one whose site taught me many things about those days. Glad to get a chance to say (tips hat) thanks for the info. :) Wish modern systems were designed and implemented with even half the skill that VMS, etc were. I've never gotten to experience an OS reliable enough that I temporarily forgot reboot command. Desktop Linux will have to do. ;)

Thanks.

re: "those days" — FWIW, those days are still ongoing. The latest OpenVMS release shipped out in June 2015, and the native port to x86-64 is underway.

Re: What is a 'unikernel'?

#66

Post by nickpsecurity »

Hoff wrote: post #65
nickpsecurity wrote: post #44

Earlier quoted context omitted.

Not just another that knows of VMS and the prior innovations but one whose site taught me many things about those days. Glad to get a chance to say (tips hat) thanks for the info. :) Wish modern systems were designed and implemented with even half the skill that VMS, etc were. I've never gotten to experience an OS reliable enough that I temporarily forgot reboot command. Desktop Linux will have to do. ;)

Thanks. re: "those days" — FWIW, those days are still ongoing. The latest OpenVMS release shipped out in June 2015, and the native port to x86-64 is underway.

I knew HP would kill it after acquisition due to rule of no competing product lines (i.e. VMS vs NonStop). I was relieved that they spun it off to another company that began a Xeon port. Two quick questions that you might know already if you've contacted them:

1. Has the company been more clear privately than the website on how long it will be before a Xeon port materializes?

2. Have they significantly reduced the OpenVMS licensing costs that kept many off it?

Re: What is a 'unikernel'?

#67

Post by nickpsecurity »

pjmlp wrote: post #53
nickpsecurity wrote: post #41

Earlier quoted context omitted.

Especially given there were more effective and efficient systems designed back in the 70's for doing exactly what we're doing now. Just better. ;)

And written in safer systems programming languages! :)

With one being on same PDP-11 as UNIX and more portable. The more I learn, the more I want to give modern computing stacks the Double Middle Finger. :)

Re: What is a 'unikernel'?

#68

Post by alblue »

zakk wrote: post #59

Not an expert here, but it seems to me like unikernel is the latest buzzword. The alleged advantages are: > Improved security: only the core of the OS is implemented, no video or USB drivers that aren't needed and could be a source of intrusion. I am not aware of any video or USB driver vulnerability which led to security concerns on a typical server setup in the last decade. > Very small footprint: imagine being abl…

> I am not aware of any video or USB driver vulnerability > which led to security concerns on a typical server setup > in the last decade.

CVE-2015-3456 was raised in April which had a privilege escalation due to a floppy driver controller, and caused widespread reboots and replacements of images in the Amazon cloud:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456

Re: What is a 'unikernel'?

#69

Post by Hoff »

nickpsecurity wrote: post #66
Hoff wrote: post #65

Earlier quoted context omitted.

Thanks. re: "those days" — FWIW, those days are still ongoing. The latest OpenVMS release shipped out in June 2015, and the native port to x86-64 is underway.

I knew HP would kill it after acquisition due to rule of no competing product lines (i.e. VMS vs NonStop). I was relieved that they spun it off to another company that began a Xeon port. Two quick questions that you might know already if you've contacted them: 1. Has the company been more clear privately than the website on how long it will be before a Xeon port materializes? 2. Have they significantly reduced the Op…

In no particular order...

OpenVMS and NonStop (NSK) do not compete. Entirely different products and markets.

VMS Software Inc (VSI) have licensed OpenVMS from HPE. They've not acquired the product.

The company was newly formed, not a spin-off of HP.

VSI have been circumspect on their x86-64 release schedule.

The team includes many of the same development folks that ported OpenVMS from Alpha to Itanium.

OpenVMS I64 Itanium software list prices are unchanged from those of HPE. Whether and how much the VSI sales reps might be discounting, you'd have to ask them.

Related: http://labs.hoffmanlabs.com/node/1917 http://www.vmssoftware.com/pdfs/VSI_DrawerSt_v2.pdf

Re: What is a 'unikernel'?

#70

Post by grogenaut »

grogenaut wrote: post #36
asymmetric wrote: post #28

I don't understand the point of running a unikernel inside a Docker container. I mean, Docker runs on top of the Linux kernel, so how is this reducing the stack in any way?

in general you would run it inside of xen or other hypervisor. iirc in docker the one thing you CANT change is the kernel.

take a look at github.com/tv42/alone
Post reply on HN