Live data from Hacker News

A unikernel experiment: A VM for every URL

skjegstad.com

31–34 of 34 posts

Re: A unikernel experiment: A VM for every URL

#31

I'm not sure what the applications/market for this is or could be, but I love the idea. Everything that goes "micro" I love dearly.

I'm no DNS or security expert, but couldn't one application be increased security of connections? E.g. it's harder to do that 0day kernel hack with a buffer overflow if every URL request is sandboxed in a VM?

I probably got it wrong but I'd love to hear a more expert opinion on why/why not this could be used for security..

Re: A unikernel experiment: A VM for every URL

#32
post #27

Earlier quoted context omitted.

> "What is too heavyweight is a VM image of a conventional operating system distribution with all of the baggage that it brings." Indeed. I didn't realise that Docker/Container folks had ever said VMs were too heavyweight. Is this linked anywhere? > "Would these fine-grained unikernels also run well on KVM, VMware ESXi, Hyper-V, or bhyve (FreeBSD's new VMM)?" We've been asked this before and for KVM at least, it just…

> Indeed. I didn't realise that Docker/Container folks had ever said VMs were too heavyweight. Is this linked anywhere? https://github.com/docker/docker#user-content-better-than-vm...

Thanks. In hindsight that should have been an obvious place for me to look.

Re: A unikernel experiment: A VM for every URL

#33
This is an interesting experiment in moving the computation to the endpoints of a namespace. I would suggest a variant where instead of a VM you place a Fossil file

https://www.fossil-scm.org/index.html/doc/trunk/www/fileform...

Using that you can store a whole filesystem at the URL instead of one file, and you also get synchronization mechanisms built in, so your endpoints can communicate with each other in a structured way that you control.. vs the undefined communication you will get between VM's if you try this with the VM architecture.

Post reply on HN