5 ms·

The RustyHermit Unikernel

125 points by adamnemecek 6y ago

iampims 6y ago
I find Unikernels fascinating, but I’m curious as to who is running unikernel based applications in production?
- monocasa 6y ago
  Most RTOSes. z/TPF is also a unikernel so Visa when processing every transaction.
  - nderjung 6y ago
    Did not realise Visa was using z/TPF. Do you have a link with more information?
    - monocasa 6y ago
      I don't know of much public information other than their job postings.
  - felipehuici 6y ago
    Interesting, do you have any references explaining how/why z/TPF is a unikernel? Thanks!
    - monocasa 6y ago
      It's from an era before ubiquitous MMUs, even in IBM mainframes. It therefore was structured as a library OS, with even less separation between it and the application code than even MSDOS and it's applications. Transaction Processing Facility: A Guide for Application Programmers by R. Jason Martin is a decent book I'd recommend on the subject.
- jdc 6y ago
  Most devices are not web servers.
- pjmlp 6y ago
  Game consoles, and back in the day most MS-DOS, Amiga and Atari Games that only used hardware directly with OS services could in retrospective be considered some form of unikernels. Amiga games used to be written such that they would boot the computer from floppy.
  - user-the-name 6y ago
    The Amiga had a large part of its regular OS libraries in ROM, and the base OS was available directly to the bootloader on the floppy. You could ignore it and access the hardware directly, if you wanted, and many games did, but you could also use the OS if you wanted to. The default bootloader would basically just say "launch the default shell and tell it to load the startup shell script file".
- fulafel 6y ago
  The MirageOS people at https://mirage.io/wiki/gallery https://mirage.io/wiki/gallery have a list titled "unikernels that are used in production"
  - deleted 6y ago
    [deleted]
- eb0la 6y ago
  I believe Cisco had an unikernel running on Vmware for SDN vSwitches. Makes sense: you "only" need to move packets from some vLan to another vLan/vNic after applying policies... and you can forget about supporting hardware modules alien to you.
- felipehuici 6y ago
  The automotive domain definitely use them (e.g., Open Synergy and others), since their efficiency means they consume fewer resources on ECUs, and their relatively small Trusted Computing Base (TCB) not only reduces exploits but also means certification is cheaper/faster.
lumost 6y ago
I'd be curious how long such a kernel takes to boot. There could be useful applications in container hosting.
- monocasa 6y ago
  Measured in milliseconds typically.
  - viraptor 6y ago
    There was an example running on erlang-on-xen (later renamed ling) which spawned a vm per request. When not hammered by traffic from aggregator sites, it could respond in a few milliseconds.
    - dizz 6y ago
      Jitsu? https://www.usenix.org/system/files/conference/nsdi15/nsdi15-paper-madhavapeddy.pdf https://www.usenix.org/system/files/conference/nsdi15/nsdi15...
      - felipehuici 6y ago
        No, it was not Jitsu. Jitsu is based on MiragOS/OCaml, Erlang-on-Xen was also a Xen-based unikernel like MirageOS but was (as you can guess) Erlang specific. I think you can now find it at https://github.com/cloudozer/ling https://github.com/cloudozer/ling .
- nderjung 6y ago
  10s of milliseconds (fig. 4)[0] [0]: https://pub.nderjung.net/papers/emsoft20.pdf https://pub.nderjung.net/papers/emsoft20.pdf
- felipehuici 6y ago
  A hello world unikernel was reported to take 4 ms a few years back (http://cnp.neclab.eu/projects/lightvm/lightvm.pdf http://cnp.neclab.eu/projects/lightvm/lightvm.pdf). Here's a more recent project: http://www.unikraft.org/ http://www.unikraft.org/ .
cies 6y ago
Very interesting. As an application dev I'm curious to know what it would take to have a, let's say, Actix-web stack bundled with a unikernel, or a MeiliSearch engine bundled with a unikernel. Both of these now live in Docker containers along with a whole Alpine system. I'm correct to believe that unikernels could change this, right?
- cies 6y ago
  I learned that for MirageOS it was still a long road before it's be possible to use some OCaml webframework on top of it.
  - anuragsoni 6y ago
    Lwt [1] based web frameworks can be used on MirageOS if they provide an interface that allows someone to swap out the unix dependent pieces. One such framework is Opium [2], that provides most of its features in a unix independent code library `opium_kernel`. Its fairly straightforward to run an opium app on mirage. This example needs to be updated to the newest apis in the released version of Opium but this can provide some hints about how to run an opium app on mirage: https://github.com/anuragsoni/ocaml-opium-unikernel https://github.com/anuragsoni/ocaml-opium-unikernel. If a lower level web toolkit is sufficient then ocaml's cohttp [3] library has been available on mirage for quite some time now. [1] https://github.com/ocsigen/lwt/ https://github.com/ocsigen/lwt/ [2] https://github.com/rgrinberg/opium https://github.com/rgrinberg/opium [3] https://github.com/mirage/ocaml-cohttp/ https://github.com/mirage/ocaml-cohttp/
    - cies 6y ago
      Thanks for chiming in! Sadly cohttp is (or was) performing so bad that it is kind of at odds with using it on a unikernel. This one is quite a bit faster: https://github.com/inhabitedtype/httpaf https://github.com/inhabitedtype/httpaf
      - anuragsoni 6y ago
        The `opium_kernel` example I linked to above is running on top of https://github.com/dinosaure/paf-le-chien https://github.com/dinosaure/paf-le-chien which is a mirage layer for httpaf. Opium itself has also moved to using httpaf as the underlying layer.
cies 6y ago
There is not POSIX in a unikernel, right? So can apps using a RustyHermit use the std lib, or should all be no_std?
- felipehuici 6y ago
  I suppose the right answer is "it depends". For most unikernels the answer is no: they are highly specialized, often targeting a single application or language, and built on top of small/basic OSes. Some of them have targeted various levels of POSIX compatibility, e.g., OSv (http://osv.io/ http://osv.io/) and HermiTux (https://ssrg-vt.github.io/hermitux/ https://ssrg-vt.github.io/hermitux/) though they don't always support a large number of syscalls/applications. An older project was Rump (largely abandoned), which used the NetBSD kernel to be (mostly) POSIX compatible, though performance wasn't great and it's largely abandoned. An active project targeting at least partial POSIX compatibility is Unikraft (http://www.unikraft.org/ http://www.unikraft.org/).
  - cies 6y ago
    So can I use Rust's std on RustyHermit?

125 points by adamnemecek 6y ago

iampims 6y ago

I find Unikernels fascinating, but I’m curious as to who is running unikernel based applications in production?

monocasa 6y ago
Most RTOSes. z/TPF is also a unikernel so Visa when processing every transaction.
- nderjung 6y ago
  Did not realise Visa was using z/TPF. Do you have a link with more information?
  - monocasa 6y ago
    I don't know of much public information other than their job postings.
- felipehuici 6y ago
  Interesting, do you have any references explaining how/why z/TPF is a unikernel? Thanks!
  - monocasa 6y ago
    It's from an era before ubiquitous MMUs, even in IBM mainframes. It therefore was structured as a library OS, with even less separation between it and the application code than even MSDOS and it's applications. Transaction Processing Facility: A Guide for Application Programmers by R. Jason Martin is a decent book I'd recommend on the subject.
jdc 6y ago
Most devices are not web servers.
pjmlp 6y ago
Game consoles, and back in the day most MS-DOS, Amiga and Atari Games that only used hardware directly with OS services could in retrospective be considered some form of unikernels. Amiga games used to be written such that they would boot the computer from floppy.
- user-the-name 6y ago
  The Amiga had a large part of its regular OS libraries in ROM, and the base OS was available directly to the bootloader on the floppy. You could ignore it and access the hardware directly, if you wanted, and many games did, but you could also use the OS if you wanted to. The default bootloader would basically just say "launch the default shell and tell it to load the startup shell script file".
fulafel 6y ago
The MirageOS people at https://mirage.io/wiki/gallery https://mirage.io/wiki/gallery have a list titled "unikernels that are used in production"
- deleted 6y ago
  [deleted]
eb0la 6y ago
I believe Cisco had an unikernel running on Vmware for SDN vSwitches. Makes sense: you "only" need to move packets from some vLan to another vLan/vNic after applying policies... and you can forget about supporting hardware modules alien to you.
felipehuici 6y ago
The automotive domain definitely use them (e.g., Open Synergy and others), since their efficiency means they consume fewer resources on ECUs, and their relatively small Trusted Computing Base (TCB) not only reduces exploits but also means certification is cheaper/faster.

lumost 6y ago

I'd be curious how long such a kernel takes to boot. There could be useful applications in container hosting.

monocasa 6y ago
Measured in milliseconds typically.
- viraptor 6y ago
  There was an example running on erlang-on-xen (later renamed ling) which spawned a vm per request. When not hammered by traffic from aggregator sites, it could respond in a few milliseconds.
  - dizz 6y ago
    Jitsu? https://www.usenix.org/system/files/conference/nsdi15/nsdi15-paper-madhavapeddy.pdf https://www.usenix.org/system/files/conference/nsdi15/nsdi15...
    - felipehuici 6y ago
      No, it was not Jitsu. Jitsu is based on MiragOS/OCaml, Erlang-on-Xen was also a Xen-based unikernel like MirageOS but was (as you can guess) Erlang specific. I think you can now find it at https://github.com/cloudozer/ling https://github.com/cloudozer/ling .
nderjung 6y ago
10s of milliseconds (fig. 4)[0] [0]: https://pub.nderjung.net/papers/emsoft20.pdf https://pub.nderjung.net/papers/emsoft20.pdf
felipehuici 6y ago
A hello world unikernel was reported to take 4 ms a few years back (http://cnp.neclab.eu/projects/lightvm/lightvm.pdf http://cnp.neclab.eu/projects/lightvm/lightvm.pdf). Here's a more recent project: http://www.unikraft.org/ http://www.unikraft.org/ .

cies 6y ago

Very interesting. As an application dev I'm curious to know what it would take to have a, let's say, Actix-web stack bundled with a unikernel, or a MeiliSearch engine bundled with a unikernel. Both of these now live in Docker containers along with a whole Alpine system. I'm correct to believe that unikernels could change this, right?

cies 6y ago
I learned that for MirageOS it was still a long road before it's be possible to use some OCaml webframework on top of it.
- anuragsoni 6y ago
  Lwt [1] based web frameworks can be used on MirageOS if they provide an interface that allows someone to swap out the unix dependent pieces. One such framework is Opium [2], that provides most of its features in a unix independent code library `opium_kernel`. Its fairly straightforward to run an opium app on mirage. This example needs to be updated to the newest apis in the released version of Opium but this can provide some hints about how to run an opium app on mirage: https://github.com/anuragsoni/ocaml-opium-unikernel https://github.com/anuragsoni/ocaml-opium-unikernel. If a lower level web toolkit is sufficient then ocaml's cohttp [3] library has been available on mirage for quite some time now. [1] https://github.com/ocsigen/lwt/ https://github.com/ocsigen/lwt/ [2] https://github.com/rgrinberg/opium https://github.com/rgrinberg/opium [3] https://github.com/mirage/ocaml-cohttp/ https://github.com/mirage/ocaml-cohttp/
  - cies 6y ago
    Thanks for chiming in! Sadly cohttp is (or was) performing so bad that it is kind of at odds with using it on a unikernel. This one is quite a bit faster: https://github.com/inhabitedtype/httpaf https://github.com/inhabitedtype/httpaf
    - anuragsoni 6y ago
      The `opium_kernel` example I linked to above is running on top of https://github.com/dinosaure/paf-le-chien https://github.com/dinosaure/paf-le-chien which is a mirage layer for httpaf. Opium itself has also moved to using httpaf as the underlying layer.

cies 6y ago

There is not POSIX in a unikernel, right? So can apps using a RustyHermit use the std lib, or should all be no_std?

felipehuici 6y ago
I suppose the right answer is "it depends". For most unikernels the answer is no: they are highly specialized, often targeting a single application or language, and built on top of small/basic OSes. Some of them have targeted various levels of POSIX compatibility, e.g., OSv (http://osv.io/ http://osv.io/) and HermiTux (https://ssrg-vt.github.io/hermitux/ https://ssrg-vt.github.io/hermitux/) though they don't always support a large number of syscalls/applications. An older project was Rump (largely abandoned), which used the NetBSD kernel to be (mostly) POSIX compatible, though performance wasn't great and it's largely abandoned. An active project targeting at least partial POSIX compatibility is Unikraft (http://www.unikraft.org/ http://www.unikraft.org/).
- cies 6y ago
  So can I use Rust's std on RustyHermit?