18 ms·
IncludeOS: a minimal unikernel operating system for C++ services
- StavrosK 7y agoThis looks great, but I'm wary of projects that sound this great but don't include a "downsides" section. I'd love to know what the tradeoffs are, so I don't have to spend time discovering them myself. Please consider adding a section like that.
- tomashubelbauer 7y agoThey link to one: > A longer list of features and limitations can be found on our documentation site. But unfortunately it looks like the linked page doesn't actually talk about limitations :) Unless you consider a warning about hlt-ing yourself in the foot a list of limitations I guess.
- fwsgonzo 7y agoSome downsides then: - You can't just port anything to IncludeOS. Since you have direct hardware control and you can schedule work directly to numbered CPUs you can take advantage of things, but if you don't do that then you are just living in a limited C++ environment. - The network stack hasn't been built with multiprocessing in mind, and some parts need to be rebuilt because of that - There are codepaths that could lead to C++ exceptions, such as being out of memory, which trounces performance. - There is a paging and memory allocation system in the OS which doesn't have to be there (for example paging can be "burned in" to the image for the most part, while only leaving room for adding pages for stacks. Memory can be handled by donating everything to the C standard library) - the goal being to keep the attack surface lower. - Debugging is hard - you will have to connect to GDB while pausing somewhere in the OS. This is really just me thinking out loud. Add salt.
- MaxBarraclough 7y agoThere was a damning security paper (not peer-reviewed) about IncludeOS, a few months ago. It turned up on HN: https://news.ycombinator.com/item?id=19738905 https://news.ycombinator.com/item?id=19738905 I don't know whether things have improved since then.
- Quequau 7y agoIs this project still active? I don't think it is any more.
- sm4rk0 7y ago> Sorry, but no. There are things happening here and there, for example pthreads just got merged, but otherwise development is very slow. There are plans to run on RPI4 soon (TM), if that's of any interest, otherwise the general development is low-frequent. https://github.com/includeos/IncludeOS/issues/2183 https://github.com/includeos/IncludeOS/issues/2183
- zamadatix 7y agoThe Pi 4 would be cool. I've always wanted to mess with a unikernel but they either seemed to be dead, barely started, or written in an unusual choice of language. Anyone else have a unikernel recommendation besides IncludeOS + rpi 4?
- Quequau 7y agoIf you are interested in Rust, there's HermitCore and you can run them on the Raspberry Pi via Firecracker. https://hermitcore.org/ https://hermitcore.org/
- dnpp123 7y agoHappy to see that as the top HN link. A shame it is done in C++ tho. We all know this kind of project should be done in Rust. When will there be a decent Rust unikernel as a drop in replacement for the standard lib/async-std/tokio/whatever ? Imagine deploying a safe REST Api as a 20MB image on top of Xen/KVM, with performances on par as a JS equivalent... nobody would use containers then.
- BossingAround 7y ago> We all know this kind of project should be done in Rust As a user, I don't care whether the tool is in Go, C++, Rust, or whatever else. If Docker was written in C (or Rust, or whatever else), it would have zero effect on my usage of Docker.
- resoluteteeth 7y agoThe description on github is much clearer: > IncludeOS is a minimal unikernel operating system for C++ services running in the cloud and on real hardware.
- s_Hogg 7y agoThis is quite helpful, thanks. What would prompt someone to go this way, I wonder? There are some pretty minimal OS options out there these days.
- minxomat 7y agoSee the recent ccc talk on the co2 footprint of services.
- 3fe9a03ccd14ca5 7y agoI can’t believe this is a thing. Are software engineers in the “ban straws” phase of global warming now?
- munmaek 7y agoA better question is Why Not? Is it really so inconceivable to try to apply energy conservation to computing as well?
- 3fe9a03ccd14ca5 7y agoMore meaningless policy, more meaningless laws. Addressing not the root of the problem but the fashionable tail. Always busy but never effective. The mark of a subpar engineer and a subpar citizen.
- teawrecks 7y agoYou're sliding down the slippery slope argument you've created. No one said anything about laws.
- dastx 7y agoIt'll be interesting to write a container system using this and build an orchestrated with this in mind. Would give you a truly minimal container OS.
- weberc2 7y ago“Container” and “OS” don’t mean anything in the context of unikernels. Unikernels are applications with everything they need to run (on bare metal or a hypervisor) baked into the application. So there is no OS to speak of, and the “orchestrator” is probably something like AWS EC2.
- eyberg 7y agoThere is no need for containers in this architecture.
- dastx 7y agoUsing includeOS with an application would require installation as an OS, whether on a VM or bare metal. Either way, it would take up many resources. This would be great if the application is a resource heavy app and thus would mostly utilise most/all resources. But for most apps this isn't the case. Hence they're better to be in containers so that multiple applications can be run. I'm thinking as an alternative to CoreOS or COS. These OSs will likely have a relatively high overhead in comparison to IncludeOS should such an OS exists.
- 1996 7y agoFor zero overhead, I have this weird idea of shipping source code, recompiling it with all the optimizations needed, and executing it without virtualization but under a different user id. So I stick to ./configure ; make ; make install
- jbverschoor 7y agoUserid means user management and context switching etc, means overhead
- 1996 7y agoThat's true. So on my own servers, software I write gets a pass and is run as root after a while. As for context swicthing etc I need some unixy bases. Instead of reinventing everything, I've found in practice that the linux kernel running my programs on baremetal (no virtualization) keeps the overhead to an acceptable minimum.
- erikpukinskis 7y agoIf you’re happy running on Linux (root or otherwise) you have I need of a unikernel.
- shawnz 7y agoSo basically your point is that the overhead of Linux is already low enough that you don't care about this project?
- temac 7y agoImaginary overhead doesn't count. Show me the benchmarks.
- chrismorgan 7y agoContext switching is expensive when you’re writing high-performance code. Conventional OSes require that you context switch to the kernel to perform I/O (disk or network), to say nothing of other processes vying for CPU time as well. All this is well-documented and -understood. The overhead is in no way imaginary. Unikernels don’t need to do context switches, by virtue of not having processes.
- moralsupply 7y agoI couldn't find a mention on what drivers for hardware devices it supports
- H8crilA 7y agoIt's basically only meant to be used on hypervisors: https://includeos.readthedocs.io/en/latest/Features.html https://includeos.readthedocs.io/en/latest/Features.html
- Paperweight 7y agoIt would be interesting to run a NodeJS clone or QuickJS (https://bellard.org/quickjs/ https://bellard.org/quickjs/) on/with this.
- heyflyguy 7y agoThis is why I love HN, I never knew about QuickJS. So yeah, that and includeOS...dude...!
- anewvillager 7y agoDuktape is also cool: https://duktape.org/ https://duktape.org/
- Paperweight 7y agoGoogled it in the morning and got this: http://runtimejs.org/ http://runtimejs.org/ Also a big collection of info on unikernels: https://github.com/cetic/unikernels https://github.com/cetic/unikernels
- Izmaki 7y agoWhat caught my eye was the openness for vulnerability disclosures. Right on the front page. Good stuff
- cstross 7y agoArticle blows it around the third para by asserting that publishers could/should make ebooks much cheaper than paper ones (because obviously paper costs money, right?). Then asserts that the retail price for the paper edition is the point ebooks should undercut by, oh, 25%. This ignores the fact that publishers are not retailers, they're manufacturers; the retail sector takes 50-70% of the price the customer pays for a book, and this includes Amazon's kindle store. In actual fact, the physical cost of goods for a paper book is less than 10% of the price the customer pays. Another 10% is editorial/typesetting costs which are exactly the same for the ebook, maybe 10% goes to the author, and 50-70% to Jeff Bezos and co.
- missjellyfish 7y agoSo basically you now run your app in ring0, with none of the security mitigations the community developed in the past ten years, and force everybody to code in c/c++. Is it just me or does that sound like a disaster waiting to happen?
- docuru 7y agoWell, remind me of “Premature optimisation is root of all devil”. This is not an optimisation, but it tripped many parts.
- pushpop 7y agoIt’s a single process running inside a sandboxed VM. That process might not have code written for reading files from disk (let alone writing them) or a full TCP/IP stack (let alone the ability to forward SSH sessions) and it certainly wouldn’t have any capabilities of launching a remote shell. So you’re not going to be susceptible to the vast majority RCE vulnerabilities that happen with even a minimal GNU/Linux port. Even if sloppy C++ coding did make you vulnerable, you’re still stuck inside the VM with literally nothing available aside that process. The bigger risk is DDoS attacks but that’s risk when writing sloppy code in any language, runtime and hosting environment.
- mavhc 7y agoWhat security systems do you need if it's the only thing running on the computer/vm/container?
- alfanick 7y agoAll of them if any external party has access to that "only thing running".
- mbreese 7y agoDo you really need something like SELinux if the “only thing running” is a network service that doesn’t have access to a file system? Even if that service was compromised, what else could be gained? Especially if the unikernel doesn’t spawn other processes. Am I missing something obvious?
- speransky 7y agoOld concept in HPC world, most of ancient supercomputers had ability to compile compute tasks with unikernel and spawn over compute nodes. Few years ago concept of Xen bases unikernels circulated in xen mail lists, but look like there was little interest in community. Includeos can be a “fat lambda” for those who want to control everything, but how many of such tasks we have
- archivist1 7y agoWould it be possible to build a C/C++ app with #include <os> at the top and then compile it to a fully bootable image, and then boot a real server using that?
- jrockway 7y agoThe industry is certainly moving towards less and less stuff included by default in a production environment. What used to be a full install of Debian with your app checked out in /var/www is now a Docker container containing only the packages you need. The even more careful people don't even use Debian, they use a stripped down distribution like Alpine. The even more careful people don't have a distribution, they just have their application and the one or two support files it needs (ca-certs usually). It is intriguing to apply this approach to OS features itself, because less dependence on the OS means that more of the kernel can be safely shared. And, of course, there is less surprise at something that is enabled by default that you don't need. (I feel like 99% of security is disabling stupid things that are on by default. With Linux, you never know if you got them all.) Being able to share the kernel safely means potentially better utilization. (The progression is dedicated machines -> hypervisor-based VMs -> multiple customers sharing the Linux kernel. gVisor exists for that last step, but I don't see anyone willing to sell me the ability to run my random container next to their mission-critical security-sensitive app, whereas people are perfectly happy to share CPUs with me if there is a hypervisor in the middle. But we're certainly moving in that direction.) It is also intriguing to imagine a world that moves the other direction; just have a giant computer with thousands of power-efficient CPUs in it and no virtualization. When a request comes in to your app, your CPU is just powered on, your app boots in a millisecond, handles the request, and shuts down. I am not sure even the big cloud providers have solved the time-of-day utilization problems; being able to turn most of the computers off at night has some potential to save money. (I would turn my workstation off at night if it booted in 1 millisecond in the morning, for example. I can also imagine some power savings for mobile devices if they could go hard off for 59 seconds out of every minute.)
- vosper 7y ago> I am not sure even the big cloud providers have solved the time-of-day utilization problems Do AWS spot prices fall at night? That would be one way of increasing utilization - assuming, of course, that there’s sufficient demand at any viable price. There most only be so many jobs people are willing to run unobserved overnight in order to save money. Or perhaps AWS (and others) are actually powering systems up and down to meet demand? That makes a lot more sense, I suppose.
- justicezyx 7y agoHad a few hangouts meeting with the original includeos team. Great technology, top tier team. Although I believe their distance to Silicone Valley and relatively cheap capital causes their difficulty.
- moonbug 7y agogood luck turning your debugging tools on anything that produces.
- ncmncm 7y agoYou debug it the same way you debug embedded systems. GDB stubs, and a mapped, shared page. Advantage over embedded being you don't need jtag hardware.
- moonbug 7y agothat's rather my point.
- H8crilA 7y agoThe good news is you can do easier debugging than through a single LED /s
- ncmncm 7y agoI debug regular apps, via gdbserver, routinely, in exactly the way one would debug embedded apps, and give up no convenience at all, but gain quite a lot. Gdb runs on my full-featured development environment, and the target process runs under docker, or on some other machine with the funny network hardware. I hardly ever start a new Gdb session; I just point it at binaries that I run wherever is convenient. Debugging a unikernel is trivially different.
- dtrailin 7y agoI'm really surprised this isn't in Rust considering security is a priority. However, I think something like this will become increasingly common for high performance cloud applications. Many programs do not need a full operating system with processes isolation and hardware drivers if they're going to run alone on a VM anyways.
- ncmncm 7y agoThe most urgent goal for this effort is usefulness. Geek trend box-checking has to come second.
- twoodfin 7y agoSo where is it being useful? A quick tour around the website was not enlightening in this regard.
- ncmncm 7y agoIt is mostly used in bespoke, proprietary projects that have extreme performance requirements, and specialized deployments. Not your garden-variety portable app. So, not typically visible. But 99+% of production software in use is more like that than what you can find online.
- dtrailin 7y agoRust is not the right choice because it's trendy, but because it provides memory and thread safety properties that are hard to enforce in C++. For systems software the advantages are huge.
- ncmncm 7y agoRust is also years away from maturity (which it probably will achieve, on schedule). Systems built today need to work with tooling that is mature today. Memory and thread safety properties can be achieved in C++ by operating at a higher level than C with mature, well-debugged, well-optimized libraries. No pointers means no pointer errors. Integer overflows are equally possible in Rust and C++. Both offer debug build modes that can watch for those.
- dang 7y agoThreads from 2015: https://news.ycombinator.com/item?id=10409292 https://news.ycombinator.com/item?id=10409292 https://news.ycombinator.com/item?id=10661746 https://news.ycombinator.com/item?id=10661746 https://news.ycombinator.com/item?id=10741350 https://news.ycombinator.com/item?id=10741350 2016: https://news.ycombinator.com/item?id=11154168 https://news.ycombinator.com/item?id=11154168 2017: https://news.ycombinator.com/item?id=13975994 https://news.ycombinator.com/item?id=13975994 2018: https://news.ycombinator.com/item?id=17848324 https://news.ycombinator.com/item?id=17848324 https://news.ycombinator.com/item?id=18390204 https://news.ycombinator.com/item?id=18390204
- psim1 7y agoIt's like sticking the program floppy into the Apple II disk drive and powering up. Or is that too simple an analogy?
- fwsgonzo 7y agoI like that analogy. I guess these images are more single-purpose minded, and often will do things read-only. Perfect for immutable infrastructure, but it's not a requirement.
- baybal2 7y agoHardware support is fairly limited
- x0054 7y agoI feel like most commenters in this thread didn’t read this page that explains the goals of the project with far more detail: http://www.includeos.org/technology.html http://www.includeos.org/technology.html
- dehrmann 7y agoI keep hoping for a model like this to displace Docker.
- H8crilA 7y agoI think the biggest bummer is the lack of threads. Everything seems to be running in a single loop: > Node.js-style callback-based programming - everything happens in one efficient thread with no I/O blocking or unnecessary guest-side context switching. Unless I'm missing something.
- smotti 7y agoA viable alternative that supports more languages is OSv: https://github.com/cloudius-systems/osv https://github.com/cloudius-systems/osv
- erichocean 7y agoThis is pointless. Run Linux and isolate it to the first core. Lock your own app to the other cores, with no context switching. Gdb works. SSH works. Awesome.
- ngcc_hk 7y agoIs there similar thing like this but for Node JS server? I think the direction is totally right. Just hope we can do this for the JS world.
- known 7y agoSounds like torrents for apps