> If you want to prevent fork/exec, that's super easy to do in a conventional Linux application: And mmap(), mprotect(), ptrace(), ..., $syscall_du_jour(). It'

> If you want to prevent fork/exec, that's super easy to do in a conventional Linux application: And mmap(), mprotect(), ptrace(), ..., $syscall_du_jour(). It's not about fork/exec, it's about limiting the APIs available to the unikernel by default and by design. Yes, you can do this for conventional Linux applications. But I wouldn't call it super easy, at least not for the vast majority of developers out there.