Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is a 'unikernel'?

ma.ttias.be

Post reply on HN
Print view View original

41–50 of 71 posts

Re: What is a 'unikernel'?

#41

Post by nickpsecurity »

woah wrote: post #6
kozukumi wrote: post #2

Am I the only one getting a bit fatigued by all of this now? I think when we hit containers I just got a bit tired of going even further down the rabbit hole. Yes I might get a little more performance or stability or whatever from a container vs a full VM or a unikernel vs a container but it just gets more frustrating to manage in my experience. Anybody else feel the same? When I just had a full VM with a full stack…

Seems pretty weird that we think it's normal to run a computer that simulates several physical computers, each running an operating system built for the mainframe in a 70s university CS department closet that then only ever runs one user and one application. You just think it's easier because you're used to it. I'm glad that this development is happening. In a few years when it's mature, we'll all have a saner setup…

Especially given there were more effective and efficient systems designed back in the 70's for doing exactly what we're doing now. Just better. ;)

Re: What is a 'unikernel'?

#42

Post by nickpsecurity »

kasey_junk wrote: post #37
alextgordon wrote: post #24

Earlier quoted context omitted.

I am exceptionally sceptical that "specialised" and "secure" are anything but opposites. "One hundred novel implementations of /dev/random" is a security nightmare. What you want is one implementation of /dev/random that everybody uses. Like uh, Linux. Same goes for every other element of the kernel. A secure kernel does not come from using (I'm sorry to say) a hipster programming language, it comes from decades of a…

The point of something like Halvm, the Haskell unikernel, is that can bring to bear a lot of formal methods for proving the components are secure. This sort of thing is untenable in a general purpose OS, but for specialized use case it makes a lot of sense. Here ( https://github.com/GaloisInc/haskell-tor ) for instance is a Tor implementation written for HalVM. The surface area for proving this implementation is secu…

You're right about where it's going on that but wrong about where it is. The reason is the compiler, state of FP security analysis, and overall TCB. So much to prove that's non-trivial and even non-obvious how before we can trust as secure the object code that started as your Haskell program linking to that.

I advise safe constructions of simple imperative or functional languages until INFOSEC research in security verification catches up to things like Haskell. That's basically subsets of C, Java, Ada, ML, and LISP with certifying or hand-compilation. I'd love a certified Haskell runtime, though. Tolmach et al were making progress in that direction and might pick it back up eventually.

Re: What is a 'unikernel'?

#43

Post by nickpsecurity »

mahyarm wrote: post #29
alextgordon wrote: post #24

Earlier quoted context omitted.

I am exceptionally sceptical that "specialised" and "secure" are anything but opposites. "One hundred novel implementations of /dev/random" is a security nightmare. What you want is one implementation of /dev/random that everybody uses. Like uh, Linux. Same goes for every other element of the kernel. A secure kernel does not come from using (I'm sorry to say) a hipster programming language, it comes from decades of a…

It wouldn't be 100 implementations of /dev/random, but one implementation per language. Security with a C / C++ based system that has to be everything to everyone is pretty much intractable. If you have a java unikernel server for example, you only have one programming language which you can understand from top to bottom with a lot of well written open source libraries. Then you have a hypervisor, from what I underst…

"Then you have a hypervisor, from what I understand can be far simpler than the linux kernel, POSIX and everything else. You only have two smaller layers to understand, versus the huge unix ecosystem stack to understand."

That's exactly it. It's how it was done in old days for highly assured systems and it still applies. Side advantage is that anything you create that you control you can apply the best software and security engineering methods possible. So, the big messy OS might be hard to hit with static or covert channel analysis but your microkernel/hypervisor/VMM might do fine.

Re: What is a 'unikernel'?

#44

Post by nickpsecurity »

Hoff wrote: post #26

While the term unikernel is fairly recent,the basic concept goes back a long time. One example of this general design is VAX ELN. The following is a brochure from the V2.2 release, from 1986: http://bitsavers.trailing-edge.com/pdf/dec/vax/vaxeln/2.0/VA... Compile and then link the application code with the particular pieces of the toolkits that you needed and with the provided kernel into a single download image, and…

Not just another that knows of VMS and the prior innovations but one whose site taught me many things about those days. Glad to get a chance to say (tips hat) thanks for the info. :)

Wish modern systems were designed and implemented with even half the skill that VMS, etc were. I've never gotten to experience an OS reliable enough that I temporarily forgot reboot command. Desktop Linux will have to do. ;)

Re: What is a 'unikernel'?

#45

Post by mentat »

rodgerd wrote: post #34
erikpukinskis wrote: post #20

Earlier quoted context omitted.

There's a huge spike of value created when you cross the threshold of "you really don't need to think about sysadmin stuff, you can just focus on the application layer." Heroku was the first to cross it, and they do a bang-up job with Rails apps, but ever since it came out there has been this sort of question hanging in the air of "how does this generalize?" A VM on something like Amazon EC2 was the best we could do…

> There's a huge spike of value created when you cross the threshold of "you really don't need to think about sysadmin stuff, you can just focus on the application layer." Right up until you discover that availability and data integrity and security are still problems, as you discover when it turns out your understanding of Amazon's AZs is faulty and your business goes offline.

Yes, like AZs share Internet peering connections in a way that is not at all visible to you.

Re: What is a 'unikernel'?

#46

Post by Twirrim »

I wonder how much of this is premature optimisation, or even optimisation targetting the wrong layer, where people would be better to focus on application changes.

Re: What is a 'unikernel'?

#47

Post by signa11 »

honest question: would elaborate run-time-environments e.g. erlang-vm considered unikernel for an application running in this environment. for example, as we now know, erlang provides some fairly low-level primitives for application execution e.g. it's own os-agnostic preemptive thread scheduling, per thread async io, per-thread-gc etc. etc.

Re: What is a 'unikernel'?

#48

Post by moonchrome »

hueving wrote: post #7
woah wrote: post #6

Earlier quoted context omitted.

Seems pretty weird that we think it's normal to run a computer that simulates several physical computers, each running an operating system built for the mainframe in a 70s university CS department closet that then only ever runs one user and one application. You just think it's easier because you're used to it. I'm glad that this development is happening. In a few years when it's mature, we'll all have a saner setup…

>In a few years when it's mature, we'll all have a saner setup to work with. I'm happy you get to work in an environment with no legacy applications that require a specific old operating system but that's not the case for a massive portion of sysadmin jobs.

Well the legacy app is a solved problem - we have VMs - let them live there and be done with it. Expose the API trough network and call it from anything you want.

Re: What is a 'unikernel'?

#49

Post by cpeterso »

Unikernels : hypervisor :: processes : traditional operating system

Joyent CTO Bryan Cantrill gave a great talk at Velocity NYC 2015 about the history of containers (going back to March 18, 1982 when Bill Joy added the chroot system call) and the problems of running containers on operating systems in VMs on hypervisors:

"Stop killing kittens and melthing the ice caps: Run containers on bare metal already!"

https://www.youtube.com/watch?v=coFIEH3vXPw

Re: What is a 'unikernel'?

#50

Post by noselasd »

Hoff wrote: post #26

While the term unikernel is fairly recent,the basic concept goes back a long time. One example of this general design is VAX ELN. The following is a brochure from the V2.2 release, from 1986: http://bitsavers.trailing-edge.com/pdf/dec/vax/vaxeln/2.0/VA... Compile and then link the application code with the particular pieces of the toolkits that you needed and with the provided kernel into a single download image, and…

This is also how most embedded applications utilizing an OS also works these days. The OS is a library, you link in whatever you need from the OS + compile time configuration of OS features etc. + link in whatever you need for your application.
Post reply on HN