A micro kernel runs drivers in userland and has a "micro" ring 0 footprint. A unikernal bundles only the necessary drivers into an OS which runs only one proces

A micro kernel runs drivers in userland and has a "micro" ring 0 footprint. A unikernal bundles only the necessary drivers into an OS which runs only one process and basically pushes multiprocess support into the hypervisor. His idea isn't yet fully baked, but it's basically having a userland os provide scheduling and permissions management for other os's on the machine. Which is a little odd because the hypervisor needs its own scheduler to decide what vm to run next, and switching from a vm, to the hypervisor, to the scheduler vm, to the hypervisor, to another vm sounds really inefficient. Why not have the scheduler in the hypervisor? Having a dedicated vm for permissions management sounds suspect as well, as you have to perform that same series of switches to decide whether a user is authenticated. I think what he really wants is actually a hypervisor. In a unikernel the hypervisor provides the memory isolation instead of the os. If we don't provide memory isolation at all it would basically transform remote code execution vulnerabilities into root privilege execution. If I can find a bug in your code or the cpython runtime I can own your machine. Memory safety is just the beginning of security, not a cure all.