12 ms·
Unikernels: No Longer an Academic Exercise?
- galois198 8y agoWhat are the best tools for experimenting with unikernels?
- bunnycorn 8y agoYou can already. Just use Linux or something similar and use the lower APIs. E.g. don't mount a filesystem, use the block device directly in your app.
- improv32 8y agoWouldn't that add a ton of overhead, if nothing is done in kernelspace and everything gets squeezed through syscalls
- perbu 8y agoI believe it comes down to your programing language preference. If you are into OCaml the Mirage Unikernel is rather complete. If C or C++ is your thing there is IncludeOS (potentially adding other language runtimes next year) and for Haskell there is HalVM. There are others as well, but AFAIK these are the ones with active development happening. Please correct me if there are active ones I've forgotten. All three support compiling your application as a Linux binary, meaning you can do most of the development and debugging using the tools you're used to, IDE with visual debuggers and the whole shebang. Once you want to run in a separate VM you can still debug, but it becomes a tad bit harder. I know how to debug IncludeOS application when they are running under Qemu or KVM. Qemu can act as a gdb remote, you just need to get it working, which is a bit of pain. And now you have the option of running it the way it is describes in the paper. I've never touched this so I don't have a feeling for how hard it is getting it to run.
- corysama 8y agoShame https://github.com/cloudozer/ling https://github.com/cloudozer/ling seems to have stalled.
- ghkbrew 8y agoRumprun[0] is another big one in the C camp. Though I think you can use basically any software that conforms to posix. [0] https://github.com/rumpkernel/rumprun/ https://github.com/rumpkernel/rumprun/
- perbu 8y agoNo commits since April. I think Antti has left the project and started a brewery or something.
- rjsw 8y agoThe Xen source tree contains an example of a minimal unikernel. Probably worth looking at the source to it even if you end up using something with more features.
- rayiner 8y agohttps://pdos.csail.mit.edu/archive/exo/ https://pdos.csail.mit.edu/archive/exo/
- hvidgaard 8y agoWhile it is possible to do, there is an important cost benefit analysis to make. All of the benefits the article lists can be a drawback as well. Say your specific network needs tweaking to get good performance, with a unikernel you must do this with all applications, while for a "traditional" monokernel you can do it once and it works for all applications. That is not to say the approach is not interesting, but it'll probably be for in some kind virtualization, where you abstract away the OS entirely, and run applications directly on the hypervisor.
- justicezyx 8y agoI am not sure the example makes sense at all. Default settings always not working for all apps. If you need to tune network, if that's a tuning for all apps, development can be done inside net lib, all apps rebuilds and release, that's not more expensive than tuning a kernel config. If you need to tune on per app basis, then unikernel is wildly safer because of the isolation.
- hvidgaard 8y agoNot everything is open source.
- justicezyx 8y agoIsn't that make my statement more true?
- deleted 8y ago[deleted]
- bunnycorn 8y agoIt's a nice exercise, but I don't see t going anywhere. 1st. I don't see that many bugs in the TCP/IP, filesystems, etc. specially those exploitable by black hat hackers, specially remote exploits. We usually see wide-spread vulnerabilities in the middleware like OpenSSH, which is in the userspace, putting everything in the app is not going to solve that, quite the contrary, we need to wait for the library maintainer to fix the bug, for the applications to integrate with the newer version of the library, and then, update all the applications. 2nd. Side-channel attacks. I'm not really confident in letting applications have that low level of hardware access. I mean, it's really easy for one application to steal the resources from another. We need authority if we are sharing peripherals. Well, we have one peripheral already that is shared by processes, that's memory and look at the mess that is a modern MMU and all the attacks on those that we have seen throughout the decades. 3rd. If we are going to implement that as a shared library, the result is exactly the same as today's micro and hybrid kernels, if we are not going to save memory and implement that as a static library, it's exactly the save as virtualization. Correct me if I'm wrong.
- justicezyx 8y agoUnikernel is about install controls to application writer. Once developers get into the workflow of writing applixations that can have fuller control of its environment, rarely one would return back to the world of opaque infrastructure and framework.
- MaxBarraclough 8y agoI'm not an expert in unikernels by any means, but it's not the case that it's the equivalent of a lightweight Linux distro plus some neat debug tools. I don't think the linked article does the idea justice. Here [0] is a good discussion of unikernels (TheRaven knows what he's talking about). ctrl-f for "You absolutely can not do the same thing with a conventional *NIX OS" https://soylentnews.org/comments.pl?sid=11888&cid=296337 https://soylentnews.org/comments.pl?sid=11888&cid=296337
- weberc2 8y agoI agree. One of the appeals of unikernels in my opinion is that (I think) they will eventually give us the things that Docker currently gives us, but with one less layer of abstraction (unikernels running on a VM orchestrator instead of containers running on a container orchestrator running on a VM orchestrator). I imagine that this is inevitable as a matter of efficiency, but it's probably such a small practical gain that we won't see much traction in the next decade.
- en4bz 8y agoSingle Root IO Virtualization (SR-IOV) has the potential to enable this. If the number of virtual functions climbs high enough for the number of process, or at least the number of critical processes, then you can just map a virtual function into all of the necessary processes. DPDK and SPDK already partially enable this but the number of virtual functions or complete lack there of for NVME devices is still a limiting factor.
- TheRealPomax 8y agoI don't quite understand the title of this article. Where is the part that explains why it's no longer an academic exercise? Nothing has been shown to now exist at a scale that makes it any more than another toy (in the academic computer science meaning of the word).
- deleted 8y ago[deleted]
- eyberg 8y agoI was personally an unikernel conference in Beijing in May. Baidu, Alibaba, VMWare, ARM and many other multi-billion dollar companies were talking about how they are rolling in support into things like their serverless infrastructure. Also - there are production deployments out there.
- TheRealPomax 8y agoVM support for unikernels is literally a prerequisite for unikernel uptake, so that's hardly surprising, but coming from academia: if a highly niche market using a thing still keeps it a mostly academic exercise, and this article does not contain anything that talks about how it has finally escaped the "mostly interesting to academics, and that handful of people who use it in their highly specialized or possibly instead just plain old 'someone once set it up and it's too critical to change now' systems".
- pjmlp 8y agoMicrosoft used their unikernel research (Drawbridge) to bring SQL Server into Linux. https://arstechnica.com/information-technology/2016/12/how-an-old-drawbridge-helped-microsoft-bring-sql-server-to-linux/ https://arstechnica.com/information-technology/2016/12/how-a... It is also how they kind of implement secure kernel in the recent versions of Windows 10.
- ksec 8y ago>Baidu, Alibaba, VMWare, ARM So in the server less future, Linux and FreeBSD will no longer be at the heart of these "Functions"? But instead they all migrate to Unikernel? At the scale they are operating I am pretty sure it make sense, if it brings 5 - 10% performance improvement along with other benefits. Not sure if I like the way things are moving in that direction though.
- akavel 8y agoWhat advantages do unikernels have over microkernels?
- eyberg 8y agoThe operating system universe is a lot bigger than most people have been led to believe. They think it's windows vs linux vs osx. If you're 'wild' you go *BSD. There's a lot more out there - unikernels in particular are similar in nature to RTOS (like the system that is on the Mars Rover) and they definitely descend from the microkernel branch of the tree. Having said that many microkernels tend to be multi-process. There are now over 10 different unikernel implementations out there currently. They all have different aims and goals but I'd say one defining characteristic amongst all of them is that they are single process by design. There's many other considerations but that's the most important one that comes to my mind.
- akavel 8y agoOk, so IIUC, that could be especially useful if I were to go quasi-embedded way, meaning at least a "fully dedicated server" (for the one and only Process ...princess?), as a unikernel might then let me get closer to the metal with little to no effort on my side. Amirite? Thanks!
- msla 8y agoUnikernels are older than microkernels, in terms of design philosophy, and owe more to VM (the IBM project from the 1960s) than later OS design. Microkernels are about splitting a single OS into what are sometimes called 'servers', whereas unikernels are individual systems running on a hypervisor; ultimately, the biggest advantage is that, in a microkernel, if one 'server' goes down (the disk server, for example) the whole system is down, whereas a single unikernel can fail without impacting any other unikernel. https://jdebp.eu/FGA/microkernel-conceptual-problems.html https://jdebp.eu/FGA/microkernel-conceptual-problems.html https://utcc.utoronto.ca/~cks/space/blog/tech/HypervisorVsMicrokernel https://utcc.utoronto.ca/~cks/space/blog/tech/HypervisorVsMi...
- 8y ago
- lixtra 8y agoCan a in kernel Webserver be understood as unikernel? I.e. https://en.m.wikipedia.org/wiki/TUX_web_server https://en.m.wikipedia.org/wiki/TUX_web_server
- perbu 8y agoSure. As long as you disable init on the server you'll have a unikernel setup. Round hole, square peg, though. Linux isn't meant to work like that.
- mitchpron 8y agoI still think it is. There's still been no push in the open source community to make tooling around Unikernels to make it user to a broader audience and a broader set of use cases.
- TimJYoung 8y agoWe're talking about pretty significant improvements in network I/O performance (among other things) with a unikernel, correct ? My understanding is that there have been several projects that have revolved around putting Linux network drivers into userspace so as to improve the throughput and avoid the kernel mode switch.
- dweekly 8y agoHere are some presentations from Google touching on reducing kernel overhead for high performance networking: https://netdevconf.org/1.2/slides/oct6/03_jerry_chu_usTCP_LKL.pdf https://netdevconf.org/1.2/slides/oct6/03_jerry_chu_usTCP_LK... https://www.usenix.org/sites/default/files/conference/protected-files/nsdi16_slides_eisenbud.pdf https://www.usenix.org/sites/default/files/conference/protec...
- TimJYoung 8y agoBeautiful, thanks for the links.
- gvb 8y agoFor the counter argument, see "Unikernels are unfit for production" January 22, 2016 - by Bryan Cantrill https://www.joyent.com/blog/unikernels-are-unfit-for-production https://www.joyent.com/blog/unikernels-are-unfit-for-product...
- toast0 8y agoI like this essay, but I think it's really pointing to a narrow space, rather than a lack of space. Bryan points out many weaknesses of unikernels, but assumes everybody needs multi-tenancy and the ability to spawn processes. And debugability is weak, but that probably depends on the application / environment you run. A lot of people want to run unikernels in a VM environment, but for me, it seems like the right application of unikernels is where you have one application that you want to expand to fill a single machine -- bare metal, boot to the application, save all the layers; there's no multi-tenancy, but if I'm running on hundreds/thousands of machines, I don't need multi-tenancy. Debugability is important, but lots of people run without a kernel debugger, so it might not be that important to everyone. If you want it, you'll have to build it, but DTrace and friends had to be built too -- and it's easier to build it a second time, since you know it's possible and what it should look like.
- mato 8y agoAnd indeed, we have built some tooling for debugging, since we wanted it: https://github.com/Solo5/solo5/blob/master/docs/debugging.md https://github.com/Solo5/solo5/blob/master/docs/debugging.md. It wasn't that hard.
- pjmlp 8y agoI would take the opinion of someone that has a piece in the game of selling OSes with a grain of salt.
- kev009 8y agoI'd like to point out that there is a unikernel called IBM's TPF which is something everybody is interacting with daily. It's used in the payment card network by Visa, as well as the airline and hotel industry for reservations. This is typically run under the hypervisors z/VM or PRSM. https://en.wikipedia.org/wiki/Transaction_Processing_Facility https://en.wikipedia.org/wiki/Transaction_Processing_Facilit... A few years ago someone trying to spin container technology did a lot of damage to other attempts at unikernels with marketing dogma, not reality. Claims of non-debugability and other FUD. It's long been standard operating procedure to trace and debug systems from outside the system's view. This is how people do bringup of new chips as well as OS ports. On hardware there is usually a dedicated debug and trace facility as part of the CPU or board support package or a firmware monitor. In a virtualized environment like a unikernel this is way easier because you can run code above the guest's ring 0 supervisor privilege against its RAM/pagetable root. Modern systems like POWER even allow debugging from the BMC, with a plan to allow full gdb sessions over that out of band interface https://github.com/open-power/pdbg https://github.com/open-power/pdbg. There's nothing implicitly wrong with unikernels, or other systems software ideas like microkernels, just because they are less popular technology at the moment. I'd encourage people to continue exploring this space.
- im_down_w_otp 8y agoThat FUD was from Bryan Cantrill (https://news.ycombinator.com/item?id=10953766 https://news.ycombinator.com/item?id=10953766) making aggressively resolute, but also easily falsifiable claims about the production-worthiness of unikernels. From the perspective of someone who'd debugged and traced unikernels from both inside the runtime (LING) and outside the runtime (xentrace), and who worked in the domain of the very z/TPF system you referenced above, the indictment seemed at-best strangely misguided and at-worst intentionally duplicitous. As you can imagine the indictment wasn't at all persuasive to me, and thus I keep exploring the space in bits and pieces where applicable.
- abrookewood 8y agoIs LING still alive? Haven't seen much project activity in a while.
- Sohcahtoa82 8y agoAfter a presentation I saw at ToorCon earlier this year, I don't trust unikernels in general. Several of them are beyond bad from a security standpoint with little to no protections from malicious software.
- zamadatix 8y agoI don't see the value in unikernel-as-a-process. Most of the syscalls save time by e.g. sending a bulk payload and having the kernel space TCP/IP implementation break that up into fragments and handle sending them to the interface. Moving the barrier halfway down now means you did all of the work and got negative performance benefits - seemingly under the guise of security... but isn't the whole point of unikernels to run hardware assisted VMs as your segmentation barrier instead of relying on software ferrying calls and data between hardware trust levels?
- perbu 8y agoThe value lies in security in this context. You also get a bit of performance as the "unikernels" are self-contained. So you can do most things, including the IP stack without switching into kernel mode. I'm guessing this is mostly interesting for FaaS platforms or similar. You get isolation similar to hardware-assisted vms but with a lot less overhead and with phenomenal boot-times.
- m0llusk 8y agoIt might be interesting, at least as an exercise, to combine unikernels with the split kernels from distributed "lego os". Having a slimmed down only what is used footprint spread out across the network could lead to multiplied advantages.