Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MirageOS 4.0 – Self-managed internet infrastructure with unikernels

mirage.io

Post reply on HN
Print view View original

21–30 of 38 posts

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#21

Post by scns »

hannesm wrote: post #12
onebot wrote: post #2

I am fascinated by Unikernels. But how do they deal with things that need to fork or run multiple processes? Aren't they restricted to single processes?

We use asynchronous tasks in MirageOS (cooperative multitasking) using lwt http://ocsigen.org/lwt/latest/manual/manual , so you can serve multiple network connections at the same time. Since there are no processes, there's no concept of "fork", but indeed you can run multiple tasks at the same time (using the same address space). Why again would you need multiple processes? Since the programming language OCaml has a…

Conurrency instead of parallelism.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#22

Post by kirschner »

imachine1980_ wrote: post #20
lokedhs wrote: post #19

MirageOS is really interested when combined with Qubes OS. I've started looking at MirageOS, and since I use Qubes, being able to run things directly on Xen right next to my regular VM's is really neat. There are also projects to replace sys-firewall with a MirageOS unikernel instead. That's something that seems very interesting.

Qubes OS?

Have a look at https://www.qubes-os.org/ It is a Free Software operating system with the focus on security.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#23

Post by fsflover »

kirschner wrote: post #22
imachine1980_ wrote: post #20

Earlier quoted context omitted.

Qubes OS?

Have a look at https://www.qubes-os.org/ It is a Free Software operating system with the focus on security.

Recent discussion: https://news.ycombinator.com/item?id=30776103.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#24

Post by gpderetta »

hannesm wrote: post #12
onebot wrote: post #2

I am fascinated by Unikernels. But how do they deal with things that need to fork or run multiple processes? Aren't they restricted to single processes?

We use asynchronous tasks in MirageOS (cooperative multitasking) using lwt http://ocsigen.org/lwt/latest/manual/manual , so you can serve multiple network connections at the same time. Since there are no processes, there's no concept of "fork", but indeed you can run multiple tasks at the same time (using the same address space). Why again would you need multiple processes? Since the programming language OCaml has a…

What about multiprocessing? I assume that MirageOS can take advantage of multiple cores (or do you need separate instances per core?). In this case is the system still shared memory?

Also I would say there are reasons for isolation beyond memory safety.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#25

Post by mwcampbell »

hannesm wrote: post #11
mindwok wrote: post #3

This project mentions it’s based on the Xen hypervisor and uses EC2 as an example for running it, but haven’t AWS now moved to their own KVM based hypervisor? Would this still work?

In ancient times, only Xen was supported. Nowadays, the support moved to: - Xen (PVH) - Linux KVM, FreeBSD BHyve, OpenBSD VMM - SPT (seccomp, no hardware virtualization) - virtio (GCE, ..) - muen (muen.sk) Take a look at https://github.com/solo5/solo5 which is used as the low level bits to run OCaml.

> - SPT (seccomp, no hardware virtualization)

To be clear, this means running an ordinary Linux binary, right?

I'm curious about the remaining advantages in practice of running multiple processes on a shared kernel rather than using hardware virtualization. I guess the main one is more efficient resource pooling, particularly memory and the page cache. I understand the primary advantage of virtualization is a smaller attack surface.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#26

Post by hannesm »

gpderetta wrote: post #24
hannesm wrote: post #12

Earlier quoted context omitted.

We use asynchronous tasks in MirageOS (cooperative multitasking) using lwt http://ocsigen.org/lwt/latest/manual/manual , so you can serve multiple network connections at the same time. Since there are no processes, there's no concept of "fork", but indeed you can run multiple tasks at the same time (using the same address space). Why again would you need multiple processes? Since the programming language OCaml has a…

What about multiprocessing? I assume that MirageOS can take advantage of multiple cores (or do you need separate instances per core?). In this case is the system still shared memory? Also I would say there are reasons for isolation beyond memory safety.

MirageOS is - similar to the latest OCaml release - only using a single CPU core. You can run multiple unikernels, one on each core. If doing that, you can use Xen vchan (shared memory), or TCP for marshalling.

> Also I would say there are reasons for isolation beyond memory safety.

Would you mind to elaborate which reasons you are thinking of?

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#27

Post by hannesm »

mwcampbell wrote: post #25
hannesm wrote: post #11

Earlier quoted context omitted.

In ancient times, only Xen was supported. Nowadays, the support moved to: - Xen (PVH) - Linux KVM, FreeBSD BHyve, OpenBSD VMM - SPT (seccomp, no hardware virtualization) - virtio (GCE, ..) - muen (muen.sk) Take a look at https://github.com/solo5/solo5 which is used as the low level bits to run OCaml.

> - SPT (seccomp, no hardware virtualization) To be clear, this means running an ordinary Linux binary, right? I'm curious about the remaining advantages in practice of running multiple processes on a shared kernel rather than using hardware virtualization. I guess the main one is more efficient resource pooling, particularly memory and the page cache. I understand the primary advantage of virtualization is a smaller…

Yes, this is an ordinary Linux binary.

The attack surface is different, you may be interested in https://archive.fosdem.org/2019/schedule/event/solo5_unikern... and/or https://archive.fosdem.org/2019/schedule/event/solo5_unikern... :)

TL;DR: hardware virtualization is pushing trust into hardware -- but can you trust the hardware implementation (to isolate memory)?

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#28

Post by rwmj »

onebot wrote: post #2

I am fascinated by Unikernels. But how do they deal with things that need to fork or run multiple processes? Aren't they restricted to single processes?

Unikernel Linux (UKL - https://github.com/unikernellinux) actually does allow you to fork. The main unikernel program runs in kernel space linked to Linux, and after a fork you get a new, regular userspace process.

Re: MirageOS 4.0 – Self-managed internet infrastructure with unikernels

#30

Post by wmf »

scns wrote: post #21
hannesm wrote: post #12

Earlier quoted context omitted.

We use asynchronous tasks in MirageOS (cooperative multitasking) using lwt http://ocsigen.org/lwt/latest/manual/manual , so you can serve multiple network connections at the same time. Since there are no processes, there's no concept of "fork", but indeed you can run multiple tasks at the same time (using the same address space). Why again would you need multiple processes? Since the programming language OCaml has a…

Conurrency instead of parallelism.

No amount of concurrency on a single core can equal the performance of multiple cores.
Post reply on HN