4 ms·

Working with Unikernel Volumes in Nanos

42 points by eyberg 6y ago

core-questions 6y ago
Does anyone use this product? Unikernels seem like they should really be the Next Big Thing - the container ecosystem has gotten too crazy, too many layers, too much cruft between what you want to run and where it's running. This seems like a really amazing alternative that brings things back to where server hardware had been evolving to go, in terms of features for virtualization and isolation. Can I run Ruby in a unikernel yet?
- eyberg 6y ago
  * We do have paying customers yes. * Yes you can run ruby. Looks like we have packages for 2.3, 2.5 and 2.7 currently - it'd be trivial to add more runtimes.
  - core-questions 6y ago
    That's awesome. I will definitely dig into this. I hope that Ruby stuff built against C also works with this (many things have native binaries that are built at gem install time for performance). While I have you - Any thoughts on support for ESXi? I have a bunch of VMware and would love to run these on top. I gather that it will run, but without hardware acceleration? What does that actually mean? Edit: Ah, https://nanovms.gitbook.io/ops/vsphere https://nanovms.gitbook.io/ops/vsphere answers some of this.
    - eyberg 6y ago
      The native libraries just need to be included onto the fs. Every interpreted language out there is like this. Also, the gem install step can be done outside of the unikernel and then have the artifacts loaded on. We have current ESXi VSphere support today - both for 6.7 and 7.0. There are some docs here: https://nanovms.gitbook.io/ops/vsphere https://nanovms.gitbook.io/ops/vsphere . When you deploy a unikernel it's packaged as a virtual machine so it's not like you are deploying a linux vm and then running this on top - you are deploying your application as it's own isolated vm and it is hardware accelerated. Without hardware acceleration the "cloud" wouldn't exist, however instead of running 2 layers of linux (hypervisor and guest) we recognize that we're virtualized and that we don't need an extra full blown linux running as guest.
      - core-questions 6y ago
        Fantastic, I will try something out against the Vsphere. So I guess I'm creating a VM template with this, similar to what I'd do with Packer, and then theoretically I should still be able to use Terraform to spin one up. What about passing run-time configuration? Is that all supposed to just be built-in, or is a well-designed program expected to reach out and get it somehow (e.g. from Consul)? Am I supposed to bake in keys to give it access to things?
        eyberg 6y ago
        You can use terraform to spin it up but a lot of that becomes un-necessary as that is assuming you are deploying a linux vm or something similar. Packer itself would be totally replaced with something like OPS - https://ops.city https://ops.city as ops produces machine images for the various hypervisors - but to be clear - you don't have to use ops but nothing else gives you a cloud deploy in 2 min and 2 commands. OPS allows you to pass quite a lot of configuration related switches/options/etc: https://nanovms.gitbook.io/ops/configuration https://nanovms.gitbook.io/ops/configuration and config files that you need on disk can be copied in at build time too. Env vars and such can be injected as well. If you want to keep using a secret store like Vault that's totally fine and up to you and your application needs. As mentioned in the article some companies use volumes to rotate certs every few hours/day via volumes so the sensitive stuff is separated from deploys.
- hacknat 6y ago
  The problem with Unikernels is legacy software. In order to effectively run Unikernels you have to program for them. I think the big jump in unikernels will come when someone can build Linux as a safe Unikernel and create a tool that converts docker images into Unikernel images. It's doable, but incredibly hard. Disclaimer: I'm sure there are lots of instances for folks where programming for Unikernels makes sense, but obviously legacy software will be around for a while.
  - gandalfgeek 6y ago
    There have been some efforts to take regular Linux binaries and build unikernels from them: - Lupine Linux uses specialization: https://www.youtube.com/watch?v=AoskLn1Xovc https://www.youtube.com/watch?v=AoskLn1Xovc - HermitCore reimplements a small subset of Linux that covers the majority of apps, so that they can run with it as a unikernel: https://www.youtube.com/watch?v=wHLqSb4Op4s https://www.youtube.com/watch?v=wHLqSb4Op4s
  - convolvatron 6y ago
    nanos in particular runs unmodified linux _binaries_ and produces bootable virtual machines
danmur 6y ago
"Unikernels are fast, secure, increase server density and eliminate devops." bold statement, by whatever definition of devops you use

42 points by eyberg 6y ago

Does anyone use this product? Unikernels seem like they should really be the Next Big Thing - the container ecosystem has gotten too crazy, too many layers, too much cruft between what you want to run and where it's running. This seems like a really amazing alternative that brings things back to where server hardware had been evolving to go, in terms of features for virtualization and isolation. Can I run Ruby in a unikernel yet?

eyberg 6y ago
* We do have paying customers yes. * Yes you can run ruby. Looks like we have packages for 2.3, 2.5 and 2.7 currently - it'd be trivial to add more runtimes.
- core-questions 6y ago
  That's awesome. I will definitely dig into this. I hope that Ruby stuff built against C also works with this (many things have native binaries that are built at gem install time for performance). While I have you - Any thoughts on support for ESXi? I have a bunch of VMware and would love to run these on top. I gather that it will run, but without hardware acceleration? What does that actually mean? Edit: Ah, https://nanovms.gitbook.io/ops/vsphere https://nanovms.gitbook.io/ops/vsphere answers some of this.
  - eyberg 6y ago
    The native libraries just need to be included onto the fs. Every interpreted language out there is like this. Also, the gem install step can be done outside of the unikernel and then have the artifacts loaded on. We have current ESXi VSphere support today - both for 6.7 and 7.0. There are some docs here: https://nanovms.gitbook.io/ops/vsphere https://nanovms.gitbook.io/ops/vsphere . When you deploy a unikernel it's packaged as a virtual machine so it's not like you are deploying a linux vm and then running this on top - you are deploying your application as it's own isolated vm and it is hardware accelerated. Without hardware acceleration the "cloud" wouldn't exist, however instead of running 2 layers of linux (hypervisor and guest) we recognize that we're virtualized and that we don't need an extra full blown linux running as guest.
    - core-questions 6y ago
      Fantastic, I will try something out against the Vsphere. So I guess I'm creating a VM template with this, similar to what I'd do with Packer, and then theoretically I should still be able to use Terraform to spin one up. What about passing run-time configuration? Is that all supposed to just be built-in, or is a well-designed program expected to reach out and get it somehow (e.g. from Consul)? Am I supposed to bake in keys to give it access to things?
      - eyberg 6y ago
        You can use terraform to spin it up but a lot of that becomes un-necessary as that is assuming you are deploying a linux vm or something similar. Packer itself would be totally replaced with something like OPS - https://ops.city https://ops.city as ops produces machine images for the various hypervisors - but to be clear - you don't have to use ops but nothing else gives you a cloud deploy in 2 min and 2 commands. OPS allows you to pass quite a lot of configuration related switches/options/etc: https://nanovms.gitbook.io/ops/configuration https://nanovms.gitbook.io/ops/configuration and config files that you need on disk can be copied in at build time too. Env vars and such can be injected as well. If you want to keep using a secret store like Vault that's totally fine and up to you and your application needs. As mentioned in the article some companies use volumes to rotate certs every few hours/day via volumes so the sensitive stuff is separated from deploys.
hacknat 6y ago
The problem with Unikernels is legacy software. In order to effectively run Unikernels you have to program for them. I think the big jump in unikernels will come when someone can build Linux as a safe Unikernel and create a tool that converts docker images into Unikernel images. It's doable, but incredibly hard. Disclaimer: I'm sure there are lots of instances for folks where programming for Unikernels makes sense, but obviously legacy software will be around for a while.
- gandalfgeek 6y ago
  There have been some efforts to take regular Linux binaries and build unikernels from them: - Lupine Linux uses specialization: https://www.youtube.com/watch?v=AoskLn1Xovc https://www.youtube.com/watch?v=AoskLn1Xovc - HermitCore reimplements a small subset of Linux that covers the majority of apps, so that they can run with it as a unikernel: https://www.youtube.com/watch?v=wHLqSb4Op4s https://www.youtube.com/watch?v=wHLqSb4Op4s
- convolvatron 6y ago
  nanos in particular runs unmodified linux _binaries_ and produces bootable virtual machines

danmur 6y ago

"Unikernels are fast, secure, increase server density and eliminate devops." bold statement, by whatever definition of devops you use