3 ms·
I think Bryan Cantrill and Joyent are doing a number of interesting things, but this reads more like an ad than a genuine critique of Unikernels. The prima
by uxcn 11y ago
I think Bryan Cantrill and Joyent are doing a number of interesting things, but this reads more like an ad than a genuine critique of Unikernels.
The primary reason to implement functionality in the
operating system kernel is for performance: by avoiding
a context switch across the user-kernel boundary,
operations that rely upon transit across that boundary
can be made faster.
I haven't heard this argument made once. There are performance benefits (smaller footprint, compiler optimization across system call boundaries, etc...). However, the primary benefit is not performance from eliminating the user/kernel boundary.
Should you have apps that can be unikernel-borne, you
arrive at the most profound reason that unikernels are
unfit for production — and the reason that (to me,
anyway) strikes unikernels through the heart when it
comes to deploying anything real in production:
Unikernels are entirely undebuggable.
If this were true, and an issue, FPGAs would also be completely unusable in production.
- nickpsecurity 11y ago"If this were true, and an issue, FPGAs would also be completely unusable in production." BOOM! And kernels. And ASIC's. And so on. Yet, we have tools to debug all of them. But unikernels? Better off trying to build a quantum computer than something that difficult...
- uxcn 11y agoIt's not the same as using something like DTrace on a live system, but he's describing it as though eliminating the flexibility implies some sort of event horizon. This also bothered me... virtualizing at the hardware layer carries with it an inexorable performance tax Hardware has been adding a lot of virtualization support over the last decade, and it's generally been a net performance gain as far as I'm aware. I could see things like IO scheduling potentially being an issue. Although, IO performance on top of operating systems in general does not particularly inspire confidence.
- nickpsecurity 11y agoNext time you see that, point out that the hardware is itself basically virtualized to monolithic OS's with microcode, shared I/O, and multiplexed buses. A version could work for unikernels if that worked for UNIX. Performance issues come more from how it's applied than the concept itself.
- jroesch 11y agoI think you guys might find Arrakis interesting: https://arrakis.cs.washington.edu/ https://arrakis.cs.washington.edu/ it won Best Paper at OSDI '14 and demonstrates a possible way to better use things like virtio.
- nickpsecurity 11y agoThat was interesting. Thanks for the link. I'll read the full papers later. Meanwhile, both Arrakis and FlexNIC are now in my collection. :)