5 ms·

The road ahead for MirageOS in 2021

84 points by lelf 6y ago

AngusH 6y ago
For those, such as myself, who were not previously familiar with it: "MirageOS is a library operating system that constructs unikernels for secure, high-performance network applications across a variety of cloud computing and mobile platforms. Code can be developed on a normal OS such as Linux or MacOS X, and then compiled into a fully-standalone, specialised unikernel that runs under a Xen or KVM hypervisor." https://mirage.io https://mirage.io It seems an interesting idea.
- cies 6y ago
  Yesterday I was made aware of this example of using a simple (Sinatra/Flask/Express-like) web framework on top of Mirage: https://github.com/anuragsoni/ocaml-opium-unikernel/blob/master/unikernel.ml https://github.com/anuragsoni/ocaml-opium-unikernel/blob/mas... If not mistaken one should be able to use ReasonML[1] as a language frontend with this as well, thereby bringing down the entry barrier. https://reasonml.github.io/docs/en/what-and-why https://reasonml.github.io/docs/en/what-and-why
- deleted 6y ago
  [deleted]
isaacimagine 6y ago
This is really interesting! Congrats on securing grant funding - I can't wait to see what MirageOS becomes. (Speaking of grants, does anyone know any funding opportunities similar to NGI Pointer but in the US?)
- ignoramous 6y ago
  US government supports one of the biggest open-tech funds which unfortunately has been on pause since last year: https://news.ycombinator.com/item?id=23636498 https://news.ycombinator.com/item?id=23636498 These are not US-only but worth a look nevertheless: https://github.com/nayafia/microgrants https://github.com/nayafia/microgrants https://nlnet.nl/propose/ https://nlnet.nl/propose/
  - isaacimagine 6y ago
    Thanks for the response :)
dataangel 6y ago
I really like the idea of unikernels, but I find it a little strange to hamper the performance of one by using Ocaml when performances one of the most significant advantages.
- pjmlp 6y ago
  It compiles to native code, has a proven history in development of security trumps performance systems.
- jeofken 6y ago
  Heap allocations are garbage collected, how is OCaml slow otherwise?
- deleted 6y ago
  [deleted]
pjmlp 6y ago
Great news, specially the deployment in production with products like NetHSM, always great to point out when someone asks where it is used if at all. https://www.nitrokey.com/products/nethsm https://www.nitrokey.com/products/nethsm
tomc1985 6y ago
And here I thought they were referring to MirageOS on the TI-83 https://www.calculatorti.com/os/mirageos/ https://www.calculatorti.com/os/mirageos/
- NanoWar 6y ago
  Me too! Better Link: https://www.ticalc.org/archives/files/fileinfo/139/13949.html https://www.ticalc.org/archives/files/fileinfo/139/13949.htm...
  - tigger0jk 6y ago
    Yup, also: Readme from ticalc.org: https://www.ticalc.org/cgi-bin/zipview?83plus/flash/shells/mirageos.zip;MirageOS.txt https://www.ticalc.org/cgi-bin/zipview?83plus/flash/shells/m... MirageOS Home Page linked in the readme: http://www.detachedsolutions.com/mirageos/ http://www.detachedsolutions.com/mirageos/
pierrebai 6y ago
I'll be a bit of a devil advocate here but both the choice of words and attitude are obscuring facts. First with a name like MirageOS and calling itself a unikernel, you'd think this was an OS. But this actually has no driver, no user-space, no file system. It receives boot parameters and communicates over TCP or UDP. Mmmm I'd call that a program that receives command-line parameters and communicates over the network. But "program" sounds a lot less exciting than "unikernel". It does not even manage memory or processes or anything like that. It uses a thin C wrapper to load on virtual machines or . Just like you could with any program that does use any OS facilities. It does not have process, praising cooperative multi-tasking over multi-threading or multi-processing. Cooperative multi-threading means every part of your system is dependent on every other part behaving correctly to yield the CPU at short interval. Mis-design any single algorithm in the system to be quadratic or worse and you can have long, unpredictable scheduling delays. Forget doing anything requiring real-time responses. Even semi-regular response times are not guaranteed under cooperation. You could achieve the same goals with a statically linked program in any languages...
- eru 6y ago
  The exciting thing is exactly that it lacks all those capabilities. Thus the attack surface is smaller. > You could achieve the same goals with a statically linked program in any languages... Typically statically linked programs still run under an operating system like Linux. (And Linux might run on top of a hypervisor.) Linux is a complicated beast, with lots of (undiscovered) vulnerabilities and bugs. MirageOS cuts out Linux. Basically, MirageOS treats the hypervisor as if it was an operating system. It's just an accident of history, that we call processes running on a hypervisor 'virtual machines', but fundamentally a hypervisor is just a special kind of OS.

84 points by lelf 6y ago

For those, such as myself, who were not previously familiar with it: "MirageOS is a library operating system that constructs unikernels for secure, high-performance network applications across a variety of cloud computing and mobile platforms. Code can be developed on a normal OS such as Linux or MacOS X, and then compiled into a fully-standalone, specialised unikernel that runs under a Xen or KVM hypervisor." https://mirage.io https://mirage.io It seems an interesting idea.

cies 6y ago
Yesterday I was made aware of this example of using a simple (Sinatra/Flask/Express-like) web framework on top of Mirage: https://github.com/anuragsoni/ocaml-opium-unikernel/blob/master/unikernel.ml https://github.com/anuragsoni/ocaml-opium-unikernel/blob/mas... If not mistaken one should be able to use ReasonML[1] as a language frontend with this as well, thereby bringing down the entry barrier. https://reasonml.github.io/docs/en/what-and-why https://reasonml.github.io/docs/en/what-and-why
deleted 6y ago
[deleted]

isaacimagine 6y ago

This is really interesting! Congrats on securing grant funding - I can't wait to see what MirageOS becomes. (Speaking of grants, does anyone know any funding opportunities similar to NGI Pointer but in the US?)

ignoramous 6y ago
US government supports one of the biggest open-tech funds which unfortunately has been on pause since last year: https://news.ycombinator.com/item?id=23636498 https://news.ycombinator.com/item?id=23636498 These are not US-only but worth a look nevertheless: https://github.com/nayafia/microgrants https://github.com/nayafia/microgrants https://nlnet.nl/propose/ https://nlnet.nl/propose/
- isaacimagine 6y ago
  Thanks for the response :)

dataangel 6y ago

I really like the idea of unikernels, but I find it a little strange to hamper the performance of one by using Ocaml when performances one of the most significant advantages.

pjmlp 6y ago
It compiles to native code, has a proven history in development of security trumps performance systems.
jeofken 6y ago
Heap allocations are garbage collected, how is OCaml slow otherwise?
deleted 6y ago
[deleted]

pjmlp 6y ago

Great news, specially the deployment in production with products like NetHSM, always great to point out when someone asks where it is used if at all. https://www.nitrokey.com/products/nethsm https://www.nitrokey.com/products/nethsm

tomc1985 6y ago

And here I thought they were referring to MirageOS on the TI-83 https://www.calculatorti.com/os/mirageos/ https://www.calculatorti.com/os/mirageos/

NanoWar 6y ago
Me too! Better Link: https://www.ticalc.org/archives/files/fileinfo/139/13949.html https://www.ticalc.org/archives/files/fileinfo/139/13949.htm...
- tigger0jk 6y ago
  Yup, also: Readme from ticalc.org: https://www.ticalc.org/cgi-bin/zipview?83plus/flash/shells/mirageos.zip;MirageOS.txt https://www.ticalc.org/cgi-bin/zipview?83plus/flash/shells/m... MirageOS Home Page linked in the readme: http://www.detachedsolutions.com/mirageos/ http://www.detachedsolutions.com/mirageos/

pierrebai 6y ago

I'll be a bit of a devil advocate here but both the choice of words and attitude are obscuring facts. First with a name like MirageOS and calling itself a unikernel, you'd think this was an OS. But this actually has no driver, no user-space, no file system. It receives boot parameters and communicates over TCP or UDP. Mmmm I'd call that a program that receives command-line parameters and communicates over the network. But "program" sounds a lot less exciting than "unikernel". It does not even manage memory or processes or anything like that. It uses a thin C wrapper to load on virtual machines or . Just like you could with any program that does use any OS facilities. It does not have process, praising cooperative multi-tasking over multi-threading or multi-processing. Cooperative multi-threading means every part of your system is dependent on every other part behaving correctly to yield the CPU at short interval. Mis-design any single algorithm in the system to be quadratic or worse and you can have long, unpredictable scheduling delays. Forget doing anything requiring real-time responses. Even semi-regular response times are not guaranteed under cooperation. You could achieve the same goals with a statically linked program in any languages...

eru 6y ago
The exciting thing is exactly that it lacks all those capabilities. Thus the attack surface is smaller. > You could achieve the same goals with a statically linked program in any languages... Typically statically linked programs still run under an operating system like Linux. (And Linux might run on top of a hypervisor.) Linux is a complicated beast, with lots of (undiscovered) vulnerabilities and bugs. MirageOS cuts out Linux. Basically, MirageOS treats the hypervisor as if it was an operating system. It's just an accident of history, that we call processes running on a hypervisor 'virtual machines', but fundamentally a hypervisor is just a special kind of OS.