2 ms·
He addresses the hypervisor as security boundary and explains not only how it sometimes fails it it's intended job and why it's insufficient by design. Further
by DasIch 11y ago
He addresses the hypervisor as security boundary and explains not only how it sometimes fails it it's intended job and why it's insufficient by design.
Further unikernels don't remove the large OS surface area they replace it with something that may or may not be larger and safer.
- im_down_w_otp 11y agoThey're definitely smaller. Whether or not they're safer depends on how you create the unikernel. Many hypervisor security flaws which allow peeking between the VM isolation boundaries rely on sloppy protections around the virtualized virtual memory subsystem. Most unikernel platforms don't even expose a virtual memory semantic, and thus don't consume these sometimes leaky hypervisor HAL implementation flaws. They don't use or expose the flimsiest floorboards in the hypervisor. A full OS (including SmartOS) on the other hand... definitely does.