This is really cool, though it looks like the security impact is nuanced. Unikernel plus: A lot of code, including code with vulnerabilities, can disappear. S

This is really cool, though it looks like the security impact is nuanced. Unikernel plus: A lot of code, including code with vulnerabilities, can disappear. So some vulnerabilities disappear. Unikernel minus: The unikernel and application don't have any security isolation, since the kernel is essentially linked into the appl. As a result, the application has all the privileges of its virtual machine (not the subset that would normally be imposed by the kernel), which would normally be more privileges than it really needs. So any remaining vulnerabilities can have a more devastating effect. That trade-off in terms of security is really hard to evaluate. But the kinds of performance improvement shown here, with relatively modest changes, is a really really big deal. So I'd expect a lot of people to investigate this further; it certainly seems promising.