4 ms·
Security. You ever run a process in its own VM for security reasons? A hypervisor is a microkernel with bloaty processes and even more hardware protections.
by maaku 11y ago
Security. You ever run a process in its own VM for security reasons? A hypervisor is a microkernel with bloaty processes and even more hardware protections.
- fleitz 11y agoThe general trend is away from this and towards containers which leave it up to a monolithic kernel to secure individual processes. Most people run VMs for hardware utilization purposes.
- derefr 11y agoThat was the trend five years ago. We're on unikernels now.
- bsaul 11y agoWho is "we" ? I had the impression unikernels were still a highly experimental work in progress you could only use with ocaml and that noone had ever used in production for anything serious.
- amirmc 11y agoIt's beyond experiments now and there are clear uses for such things. For example, a recent post describes using MirageOS to build a firewall VM [1]. There are also network security/intrusion-detection systems [2]. There are a number of ways to build unikernels and they're not all OCaml (which is just MirageOS) -- http://unikernel.org http://unikernel.org is trying to bring these together. [1] http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewal... [2] https://galois.com/project/cyberchaff/ https://galois.com/project/cyberchaff/
- bluejekyll 11y agoDon't forget standard posix stuff with rumprun.
- amirmc 11y agoYes, of course. I should also have linked to the Unikernel+Docker demo [1], which is taking legacy software and using Rump Kernels and the Docker toolchain to deploy unikernels (to show how all these things can create a multiplier effect in terms of benefits). It would be great to get a list of live unikernel deployments listed somewhere to address questions like this when they come up. [1] http://unikernel.org/blog/2015/unikernels-meet-docker/ http://unikernel.org/blog/2015/unikernels-meet-docker/
- ris 11y ago"Who is "we" ?" Hipsters.
- meddlepal 11y agoThey're pretty cutting edge still but not that experimental. I think we'll see unikernels explode in popularity towards the end of 2016 or in 2017.
- pjc50 11y agoThis, especially sel4: the microkernel is small enough for formal verification.
- nostrademons 11y agoHypervisors are much closer to exokernels. General distinction between kernel types: Monolithic kernel = all familiar kernel abstractions (processes, IPC, filesystem, virtual memory, device drivers, networking stack) are built into the kernel. Microkernel = Most kernel abstractions run as separate processes. Kernel communicates with them over IPC. Exokernel/unikernel = There are no kernel abstractions. Instead, these abstractions are built into runtime libraries that are then linked into applications. The kernel's only job is to securely multiplex the hardware, and it exports an interface that is similar to bare metal. In 2016, the exokernel is called a hypervisor, and the libOS is called a unikernel. Neokernel = the programming language's runtime library provides the primary kernel abstractions, along with any interprocess security. Machines are limited to a single programming language.
- maaku 11y agoI'm quite aware :) Most people have experience running processes in isolated VMs for security reasons. I was trying to use that as an anchor point to explain why one might want to have components of a single operating system run as separate servers, for much the same reason -- compartmentalized security.