Unikernels also run on bare metal, so it's not about swapping one sort of protection for another. Besides the differences in protection and separate processes,

Unikernels also run on bare metal, so it's not about swapping one sort of protection for another. Besides the differences in protection and separate processes, unikernels can do anything an OS can do. Some unikernels will run application software with no changes (but obviously things like fork don't work anymore). The point (for me at least) is discarding features that you don't need in return for performance and simplicity gains. Those gains are not insubstantial when you're scaling your system and you don't want to spend your money on admin staff.