They're definitely smaller. Whether or not they're safer depends on how you create the unikernel. Many hypervisor security flaws which allow peeking between t

They're definitely smaller. Whether or not they're safer depends on how you create the unikernel. Many hypervisor security flaws which allow peeking between the VM isolation boundaries rely on sloppy protections around the virtualized virtual memory subsystem. Most unikernel platforms don't even expose a virtual memory semantic, and thus don't consume these sometimes leaky hypervisor HAL implementation flaws. They don't use or expose the flimsiest floorboards in the hypervisor. A full OS (including SmartOS) on the other hand... definitely does.