If you write your unikernel in a high-level language then you can mitigate some of your security concerns. The unikernel should only have access to the data it

If you write your unikernel in a high-level language then you can mitigate some of your security concerns. The unikernel should only have access to the data it needs to, so doing multi-tenancy or isolation inside the unikernel is probably not what you want: just spin up a new unikernel for each tenant/thing you want to isolate. The hypervisor would provide isolation in this case. There is a downside, if there is a vulnerability the exploit can probably make hypercalls straight to the hypervisor, but a hypervisor can have less of an attack surface than a full OS.