Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Atmanos: Build Go programs that run directly on the Xen hypervisor

github.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#21

Post by justincormack »

zlynx wrote: post #10
ComputerGuru wrote: post #7

Earlier quoted context omitted.

Much smaller attack surface.

Not really. Now instead of having to break the application, then break the kernel it's running under and then attack the VM host, you only have to attack the app and can then go directly at the VM host. Unikernels just remove a whole security layer. May as well run the app as a user process on the host and forget the VM.

unikernels do not have to run in ring 0 although a lot of early ones did. You can run them in ring 2, and they probably never need ring 0 access after boot so there does not have to be any way to return.

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#23

Post by Timothycquinn »

Bryan Cantrill has a great post on unikernel models: https://www.joyent.com/blog/unikernels-are-unfit-for-product...

From my read, the benefits do not outweigh the costs. If you want light weight microservices, OS level virtualization is the way to go.

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#25

Post by zenlikethat »

Timothycquinn wrote: post #23

Bryan Cantrill has a great post on unikernel models: https://www.joyent.com/blog/unikernels-are-unfit-for-product... From my read, the benefits do not outweigh the costs. If you want light weight microservices, OS level virtualization is the way to go.

AtmanOS says in the README it's highly experimental and doesn't imply you should use it for production at all.

So who cares? What else is HN for if not for posting cool hacks and projects and encouraging fellow builders?

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#26

Post by im_down_w_otp »

Timothycquinn wrote: post #23

Bryan Cantrill has a great post on unikernel models: https://www.joyent.com/blog/unikernels-are-unfit-for-product... From my read, the benefits do not outweigh the costs. If you want light weight microservices, OS level virtualization is the way to go.

Brenden Gregg also has a great post on unikernel models: http://www.brendangregg.com/blog/2016-01-27/unikernel-profil...

From my read, it counters Bryan Cantrill's claim that, "unikernels are undebuggable".

From personal experience I'm also quite certain Bryan Cantrill's claim is spurious in that regard, as I've used both debugging and tracing facilities w/ LING unikernels to assess a number of runtime and clustering issues.

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#28

Post by wbl »

zlynx wrote: post #10
ComputerGuru wrote: post #7

Earlier quoted context omitted.

Much smaller attack surface.

Not really. Now instead of having to break the application, then break the kernel it's running under and then attack the VM host, you only have to attack the app and can then go directly at the VM host. Unikernels just remove a whole security layer. May as well run the app as a user process on the host and forget the VM.

Good luck getting RCE in Ocaml.

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#29

Post by pjmlp »

Timothycquinn wrote: post #23

Bryan Cantrill has a great post on unikernel models: https://www.joyent.com/blog/unikernels-are-unfit-for-product... From my read, the benefits do not outweigh the costs. If you want light weight microservices, OS level virtualization is the way to go.

He has a horse on the race, of course unikernels are unfit according to him.

Re: Atmanos: Build Go programs that run directly on the Xen hypervisor

#30

Post by diwu1989 »

pmarreck wrote: post #27
VirtualAirwaves wrote: post #24

We've been running Erlang directly on Xen with "no os" for a while. Works great and very efficient.

I have always been fascinated by this combo. Can you discuss your use-cases and wins using this stack?

might be this or something similar, http://erlangonxen.org/
Post reply on HN