9 ms·

Unikraft – Fast, Specialized Unikernels

138 points by nderjung 5y ago

MaxBarraclough 5y ago
A somewhat related question: are the major cloud providers showing any interest in unikernels?
- nderjung 5y ago
  I believe there is growing interest in providing leaner, "trimmed" runtimes for services deployed to the cloud. Today, this is seen largely by specializing the Linux kernel for, for example, container services[0] or in general[1], as much as that is possible (the paper above covers this problem in greater detail). But, Unikernels in themselves are not yet widely adopted. This is the space Unikraft is aiming to enter, providing the ultimate level of specialization for a target application. It's clear that bigger players, such as Red Hat[2] are interested in the topic of unikernels, and that cloud providers are preparing for this future too [3]. [0]: https://github.com/linuxkit/linuxkit https://github.com/linuxkit/linuxkit [1]: https://github.com/hckuo/Lupine-Linux https://github.com/hckuo/Lupine-Linux [2]: https://dl.acm.org/doi/10.1145/3317550.3321445 https://dl.acm.org/doi/10.1145/3317550.3321445 [3]: https://firecracker-microvm.github.io https://firecracker-microvm.github.io
  - rwmj 5y ago
    Indeed, Red Hat is sponsoring students at Boston University to investigate turning Linux itself into a unikernel, with myself, Larry Woodman and Ulrich Drepper mentoring them (see link [2] in posting above). You can already run some smaller programs this way, either in qemu or on baremetal.
- zeckalpha 5y ago
  https://firecracker-microvm.github.io/ https://firecracker-microvm.github.io/
  - nderjung 5y ago
    Note that this is a VMM and not a unikernel project. We can create bindings with this VMM for faster boot times and access to fast IO paths.
    - joseluisq 5y ago
      If unikernel offers excellent performance, faster boot times, throughput and memory consumption. I'm curious what are the benefits of VMM (Firecracker) in contrast to unikernel? Are not those two comparable?
      - ShroudedNight 5y ago
        They're improving different aspects that contribute to VM overhead: > ...and boot in around 1ms on top of the VMM time (total boot time 3ms-40ms). Firecracker is trying to minimize "VMM time", while the unikernel is minimizing guest overhead.
      - felipehuici 5y ago
        You can think of the VMM as the toolstack that executes the moment you send a command to start a VM up. Once it's done it hands over execution to the actual VM (i.e., the OS within the VM). Thus the total boot time is the sum of the VMM plus the actual VM boot time. In the past, both of these took a long time. With the advent of unikernels, which can boot in as little as a few milliseconds, the focus has also been on reducing VMM time.
- twic 5y ago
  What would that look like? AFAIK, today, you can already build your unikernel app into an AMI and run it on EC2. No? Is there a service which would be more useful for unikernels than this? One thing would be for there to be an official AWS unikernel SDK - basically, a rump operating system that has everything you need to run nicely on EC2, and nothing else.
  - pjmlp 5y ago
    For example app services for language runtimes like Java and .NET.
    - rjsw 5y ago
      Are there TCP/IP network stacks available for Java or .NET ?
      - skuenzer 5y ago
        With Unikraft as being a librarized unikernel system you can actually choose if the OS layer should provide you a network stack (likely written in C/C++) for your runtime or if you prefer doing it in a higher-level language. Similar to this the MirageOS folks developed a network stack in OCaml.
      - pjmlp 5y ago
        Sure, there are even bare metal deployments available for embedded development. PTC and Aicas on Java's case for example, or nanoFramework for .NET.
        skuenzer 5y ago
        This is true, there are a number of embedded frameworks that you could use as well and even run it as virtual machine too. In contrast to this we want to make it as seamless as possible by still providing you the Linux-OS-like layers if you need them. The goal is that a previously developed app for Linux should be seamless to port. The OS interfaces in the higher-level language should be the same as you have it on Linux, so no code changes.
- TechBro8615 5y ago
  They're always showing interest in lighter weight sandboxing mechanisms. For example, AWS has FireCracker which they use on Serverless, CloudFlare can run WASM workloads in V8, etc. In general, the clouds want the unit of deployable compute to be as small as possible, because it means they can make more money packing more customers into the same machines.
deleted 5y ago
[deleted]
haolez 5y ago
I'm not an expert, but from my beginner's view, unikernels feel like a hack to make hypervisors work as an app orchestration platform. Maybe this is useful regardless :)
- wongarsu 5y ago
  "hypervisors as an app orchestration platform" sounds like a good description of Kubernetes too (if we ignore the difference between OS-level virtualization and full VMs).
- js8 5y ago
  In the MS-DOS days, I used to play games on the PC, and arguably, these were all unikernels. Typically, the game had its own set of drivers and was basically running in ring 0, and immediately after start it bypassed MSDOS and did most of the HW stuff itself. This was usually good for the game because it allowed it to squeeze every last bit of performance from the machine, being completely in control. So that's definitely a possible use case.
  - twic 5y ago
    What is a late '80s kid with a box of 5¼" floppies if not an app orchestration platform?
  - codesnik 5y ago
    some games from 80ies didn't even try to retain MSDOS in memory. The only way to "exit" the game was to reboot.
    - karmakaze 5y ago
      Atari 8-bit games loaded from the boot sector so 'DOS' never even got loaded to begin with. There was still 'bios' ROM support for basic I/O (read sector, etc).
  - incrudible 5y ago
    It's similar for for console games up until the sixth generation, also many earlier systems didn't even have a BIOS. Unfortunately, today most graphics hardware relies on drivers for specific versions of specific operating systems.
halation_effect 5y ago
Best paper award at EuroSys21. [1] https://twitter.com/EuroSys_conf/status/1386979936074969093?s=20 https://twitter.com/EuroSys_conf/status/1386979936074969093?...
wiradikusuma 5y ago
So is this something I can FROM in Dockerfile? How does it work in regards to Docker/K8S?
- nderjung 5y ago
  Not quite. To get started building Unikraft unikernels, you can use kraft[0] tool which builds a bootable image. At the moment, this is the entrypoint into the ecosystem and allows you to build, for example, NGINX for KVM, Xen or bare-metal. Having said this, we have on-going work to integrate Unikraft into Kubernetes. We are very excited about this work and will be making noise and providing extra details about this very soon :) [0]: https://github.com/unikraft/kraft https://github.com/unikraft/kraft
mc_woods 5y ago
Unikernels are probably best compared to RTOS that are used in embedded systems. They dramatically reduce the guest operating system overhead for virtual machines. As the weight of the isolation technology gets smaller, we are going to see an increasing use of it as a form of security, and scalability in application designs. We've seen the first wave with microservices, but we'll see more.
- halation_effect 5y ago
  Couldn't you make a real time unikernel? Basically you should be able to modify an existing unikernel implementation to make it real time.
  - i_like_procfs 5y ago
    What kind of guarantees, mechanisms and instrumentation can unikernels provide in this space for real-time execution of code for mission critical systems?
    - halation_effect 5y ago
      I think it should be able to provide the same guarantees as a RTOS if you implement them. But then, would you call it a unikernel still or a RTOS?
  - eyberg 5y ago
    You can and there are a few use-cases we've looked at - v2v && autonomous driving.
  - throwaway894345 5y ago
    At John Deere they compile various "applications" into their home-grown JDOS (or rather for a given controller, they compile several apps and the OS into a single 'executable'). I.e., the OS is a library, which I think is the definition of a unikernel, although perhaps not since there are often several apps on a controller?
aitchnyu 5y ago
Can anybody ELI15 what does a Unikraft contains compared to Docker running a Linux distro? Can it install pip (Python) packages with compiled C modules, create and read temporary files, and other container things?
- k__ 5y ago
  I don't know about Unikraft, but as far as I know, a unikernel is an application specific OS. Think of it as if Node.js could be directly installed on a PC and no Linux is needed.
  - felipehuici 5y ago
    Yes, correct, Unikraft generates an OS that is customized to the needs of particular applications.
- jansommer 5y ago
  You can create a unikernel with Python - it's one of Unikraft's examples, but you won't be able to pip install modules out of the box. Unikraft is good if you want to run untrusted code, giving a way for developers to extend functionality on your platform in Python (or JavaScript if you use Ducktape, also in their examples) - kind of like AWS Lambda and the likes. Besides the added security from running in a virtual machine, unikernels boot extremely fast. Without applying any optimizations, I have a QuickJS unikernel that boots, runs JavaScript and shuts down within 400ms (running in Windows -> VMWare -> Linux -> KVM+QEMU). This performance would be hard to get with Docker and a Linux distro.
  - nderjung 5y ago
    This does not mean you cannot still use pip to manage Python dependencies. Simply package all the required addditional libraries from pip through a virtualenv/venv, and package this in the filesystem that the python3 Unikraft unikernel reads on boot. For more details, check out the library for details: https://github.com/unikraft/lib-python3 https://github.com/unikraft/lib-python3
deleted 5y ago
[deleted]
nderjung 5y ago
Additional links: * Homepage: https://unikraft.org https://unikraft.org * Docs: http://docs.unikraft.org http://docs.unikraft.org * GitHub: https://github.com/unikraft/unikraft https://github.com/unikraft/unikraft * Twitter: https://twitter.com/UnikraftSDK https://twitter.com/UnikraftSDK * LinkedIn: https://linkedin.com/company/unikraft-sdk https://linkedin.com/company/unikraft-sdk
filleokus 5y ago
Oh, this looks really cool! I was just research the other day how I could make a RPI running some simple LED-blinking app boot as fast as possible, this looks quite much faster than trying to strip down linux. For someone who doesn't know that much about unikernels, is it possible (or a good idea) to run a multi threaded / multi process application on there? I'm thinking of something like a python app + nginx reverse proxy, or a Go App using the built in http server?
- felipehuici 5y ago
  Hey, yes, you could and in some cases it might make sense (e.g., you need to do some packet processing as one app but you also want the control plane as another app in the same unikernel). Generally speaking unikernels have a single memory address space so don't support (or don't easily support) processes, so the apps would run on separate threads.
anentropic 5y ago
Looks promising! How do you avoid problem of creating a unikernel that appears to work, until you exercise some different code path at runtime that needs some modular OS feature you didn't think to include in the unikernel? (I have no idea if this is a real problem, just seemed like it could be from skim reading the basics)
- halation_effect 5y ago
  You could try fuzzing. But, if you do not include a modular OS feature(e.g network stack), the unikernel would not compile since it's missing symbols.
  - felipehuici 5y ago
    Yes, that's right. If you do not include a module that could potentially be used, you'd be missing that symbol and it would not compile.
    - anentropic 5y ago
      Ah good point, thanks
yawaramin 5y ago
How does this differ from MirageOS? ( https://mirage.io/ https://mirage.io/ )
- halation_effect 5y ago
  From the paper: "MirageOS [40] is an OCaml-specific unikernel focusing on type-safety, so does not support mainstream applications, and its performance, as shown in our evaluation, is sub-par with respect to other unikernel projects"
- chubot 5y ago
  Our evaluation using off-the-shelf applications such as nginx, SQLite, and Redis shows that running them on Unikraft results in a 1.7x-2.7x performance improvement compared to Linux guests AFAIK MirageOS only supports OCaml and thus not any of those applications. That is an intentional design decision to get dead code elimination, global program optimization, etc. (And FWIW I think "monoglot" OSes are a mistake for this reason; Unix is polyglot and that's a feature, not a bug. Even in contexts where a unikernel would make sense, you may need to inspect the node dynamically.)
  - skuenzer 5y ago
    It is true that MirageOS has its focus on OCaml as a type-safe language. Its libraries are implemented in OCaml. However, even with having most parts written in C in Unikraft, we are also able to apply dead-code elimination and link-time optimizations with the compiler. In principle you should even be able to combine libraries that are written with different languages. Regarding inspecting: The design does not exclude that you could add libraries to enable inspection and monitoring. We are even thinking that this is quite important for today deployments: Imagine an integration with Prometheus or a little embedded SSH shell. The difference to Unix and what we want to achieve is to utilize specialization. Unix/Linux/etc. are general purpose OSes, that are very good fits for cases where you do not know beforehand which applications you are going to run on it (e.g., end-devices like desktops, smartphones). Unikraft wants to optimize the cases where you know beforehand what you are going to run on it and where you are going to run it. It is optimizing the kernel layers and optionally also the application for the use case.
ncmncm 5y ago
This approach competes with an easier and more widely used method of running a regular process on an "isolated core", and using "kernel bypass" libraries. On such a system, the process starts up with full access to system resources while it reads config files, allocates, maps, and initializes memory, and sets up devices, and then enters its main loop where it operates solely on memory-mapped buffers and, possibly, I/O registers, running with no system calls or interruptions by the OS, potentially for months after. For example, it might use an OpenOnload library to watch a ring buffer being pushed packets by a NIC via DMA, processing the packets as they appear and updating a mapped/shared memory region with the results. It might, further, construct packet images based on its results, or what it finds in memory mapped from another process, and use the same library to trigger the NIC to send the packet images. Regular, scheduled processes may watch the mapped memory and do less timing-constrained work, such as logging events, performing file system operations, or even operating a UI, and maybe queue requests into more mapped memory polled by the isolated process. This mode of operation is quite common at high-speed stock trading firms, or to control specialized equipment with stringent timing requirements, without need to deploy a realtime OS. Usually these systems make heavy use of ring buffers to keep processes decoupled, placed in "hugetlb" 2MB-sized memory pages to minimize or even eliminate memory-map cache contention, by mapping files in /dev/hugepages. All the regular system facilities still work. The program is built with the ordinary linker. You can attach your regular debugger to the process, at startup or after it has been running for a month.

138 points by nderjung 5y ago

MaxBarraclough 5y ago

A somewhat related question: are the major cloud providers showing any interest in unikernels?

nderjung 5y ago
I believe there is growing interest in providing leaner, "trimmed" runtimes for services deployed to the cloud. Today, this is seen largely by specializing the Linux kernel for, for example, container services[0] or in general[1], as much as that is possible (the paper above covers this problem in greater detail). But, Unikernels in themselves are not yet widely adopted. This is the space Unikraft is aiming to enter, providing the ultimate level of specialization for a target application. It's clear that bigger players, such as Red Hat[2] are interested in the topic of unikernels, and that cloud providers are preparing for this future too [3]. [0]: https://github.com/linuxkit/linuxkit https://github.com/linuxkit/linuxkit [1]: https://github.com/hckuo/Lupine-Linux https://github.com/hckuo/Lupine-Linux [2]: https://dl.acm.org/doi/10.1145/3317550.3321445 https://dl.acm.org/doi/10.1145/3317550.3321445 [3]: https://firecracker-microvm.github.io https://firecracker-microvm.github.io
- rwmj 5y ago
  Indeed, Red Hat is sponsoring students at Boston University to investigate turning Linux itself into a unikernel, with myself, Larry Woodman and Ulrich Drepper mentoring them (see link [2] in posting above). You can already run some smaller programs this way, either in qemu or on baremetal.
zeckalpha 5y ago
https://firecracker-microvm.github.io/ https://firecracker-microvm.github.io/
- nderjung 5y ago
  Note that this is a VMM and not a unikernel project. We can create bindings with this VMM for faster boot times and access to fast IO paths.
  - joseluisq 5y ago
    If unikernel offers excellent performance, faster boot times, throughput and memory consumption. I'm curious what are the benefits of VMM (Firecracker) in contrast to unikernel? Are not those two comparable?
    - ShroudedNight 5y ago
      They're improving different aspects that contribute to VM overhead: > ...and boot in around 1ms on top of the VMM time (total boot time 3ms-40ms). Firecracker is trying to minimize "VMM time", while the unikernel is minimizing guest overhead.
    - felipehuici 5y ago
      You can think of the VMM as the toolstack that executes the moment you send a command to start a VM up. Once it's done it hands over execution to the actual VM (i.e., the OS within the VM). Thus the total boot time is the sum of the VMM plus the actual VM boot time. In the past, both of these took a long time. With the advent of unikernels, which can boot in as little as a few milliseconds, the focus has also been on reducing VMM time.
twic 5y ago
What would that look like? AFAIK, today, you can already build your unikernel app into an AMI and run it on EC2. No? Is there a service which would be more useful for unikernels than this? One thing would be for there to be an official AWS unikernel SDK - basically, a rump operating system that has everything you need to run nicely on EC2, and nothing else.
- pjmlp 5y ago
  For example app services for language runtimes like Java and .NET.
  - rjsw 5y ago
    Are there TCP/IP network stacks available for Java or .NET ?
    - skuenzer 5y ago
      With Unikraft as being a librarized unikernel system you can actually choose if the OS layer should provide you a network stack (likely written in C/C++) for your runtime or if you prefer doing it in a higher-level language. Similar to this the MirageOS folks developed a network stack in OCaml.
    - pjmlp 5y ago
      Sure, there are even bare metal deployments available for embedded development. PTC and Aicas on Java's case for example, or nanoFramework for .NET.
      - skuenzer 5y ago
        This is true, there are a number of embedded frameworks that you could use as well and even run it as virtual machine too. In contrast to this we want to make it as seamless as possible by still providing you the Linux-OS-like layers if you need them. The goal is that a previously developed app for Linux should be seamless to port. The OS interfaces in the higher-level language should be the same as you have it on Linux, so no code changes.
TechBro8615 5y ago
They're always showing interest in lighter weight sandboxing mechanisms. For example, AWS has FireCracker which they use on Serverless, CloudFlare can run WASM workloads in V8, etc. In general, the clouds want the unit of deployable compute to be as small as possible, because it means they can make more money packing more customers into the same machines.

deleted 5y ago

[deleted]

haolez 5y ago

I'm not an expert, but from my beginner's view, unikernels feel like a hack to make hypervisors work as an app orchestration platform. Maybe this is useful regardless :)

wongarsu 5y ago
"hypervisors as an app orchestration platform" sounds like a good description of Kubernetes too (if we ignore the difference between OS-level virtualization and full VMs).
js8 5y ago
In the MS-DOS days, I used to play games on the PC, and arguably, these were all unikernels. Typically, the game had its own set of drivers and was basically running in ring 0, and immediately after start it bypassed MSDOS and did most of the HW stuff itself. This was usually good for the game because it allowed it to squeeze every last bit of performance from the machine, being completely in control. So that's definitely a possible use case.
- twic 5y ago
  What is a late '80s kid with a box of 5¼" floppies if not an app orchestration platform?
- codesnik 5y ago
  some games from 80ies didn't even try to retain MSDOS in memory. The only way to "exit" the game was to reboot.
  - karmakaze 5y ago
    Atari 8-bit games loaded from the boot sector so 'DOS' never even got loaded to begin with. There was still 'bios' ROM support for basic I/O (read sector, etc).
- incrudible 5y ago
  It's similar for for console games up until the sixth generation, also many earlier systems didn't even have a BIOS. Unfortunately, today most graphics hardware relies on drivers for specific versions of specific operating systems.

halation_effect 5y ago

Best paper award at EuroSys21. [1] https://twitter.com/EuroSys_conf/status/1386979936074969093?s=20 https://twitter.com/EuroSys_conf/status/1386979936074969093?...

wiradikusuma 5y ago

So is this something I can FROM in Dockerfile? How does it work in regards to Docker/K8S?

nderjung 5y ago
Not quite. To get started building Unikraft unikernels, you can use kraft[0] tool which builds a bootable image. At the moment, this is the entrypoint into the ecosystem and allows you to build, for example, NGINX for KVM, Xen or bare-metal. Having said this, we have on-going work to integrate Unikraft into Kubernetes. We are very excited about this work and will be making noise and providing extra details about this very soon :) [0]: https://github.com/unikraft/kraft https://github.com/unikraft/kraft

mc_woods 5y ago

Unikernels are probably best compared to RTOS that are used in embedded systems. They dramatically reduce the guest operating system overhead for virtual machines. As the weight of the isolation technology gets smaller, we are going to see an increasing use of it as a form of security, and scalability in application designs. We've seen the first wave with microservices, but we'll see more.

halation_effect 5y ago
Couldn't you make a real time unikernel? Basically you should be able to modify an existing unikernel implementation to make it real time.
- i_like_procfs 5y ago
  What kind of guarantees, mechanisms and instrumentation can unikernels provide in this space for real-time execution of code for mission critical systems?
  - halation_effect 5y ago
    I think it should be able to provide the same guarantees as a RTOS if you implement them. But then, would you call it a unikernel still or a RTOS?
- eyberg 5y ago
  You can and there are a few use-cases we've looked at - v2v && autonomous driving.
- throwaway894345 5y ago
  At John Deere they compile various "applications" into their home-grown JDOS (or rather for a given controller, they compile several apps and the OS into a single 'executable'). I.e., the OS is a library, which I think is the definition of a unikernel, although perhaps not since there are often several apps on a controller?

aitchnyu 5y ago

Can anybody ELI15 what does a Unikraft contains compared to Docker running a Linux distro? Can it install pip (Python) packages with compiled C modules, create and read temporary files, and other container things?

k__ 5y ago
I don't know about Unikraft, but as far as I know, a unikernel is an application specific OS. Think of it as if Node.js could be directly installed on a PC and no Linux is needed.
- felipehuici 5y ago
  Yes, correct, Unikraft generates an OS that is customized to the needs of particular applications.
jansommer 5y ago
You can create a unikernel with Python - it's one of Unikraft's examples, but you won't be able to pip install modules out of the box. Unikraft is good if you want to run untrusted code, giving a way for developers to extend functionality on your platform in Python (or JavaScript if you use Ducktape, also in their examples) - kind of like AWS Lambda and the likes. Besides the added security from running in a virtual machine, unikernels boot extremely fast. Without applying any optimizations, I have a QuickJS unikernel that boots, runs JavaScript and shuts down within 400ms (running in Windows -> VMWare -> Linux -> KVM+QEMU). This performance would be hard to get with Docker and a Linux distro.
- nderjung 5y ago
  This does not mean you cannot still use pip to manage Python dependencies. Simply package all the required addditional libraries from pip through a virtualenv/venv, and package this in the filesystem that the python3 Unikraft unikernel reads on boot. For more details, check out the library for details: https://github.com/unikraft/lib-python3 https://github.com/unikraft/lib-python3

deleted 5y ago

[deleted]

nderjung 5y ago

Additional links: * Homepage: https://unikraft.org https://unikraft.org * Docs: http://docs.unikraft.org http://docs.unikraft.org * GitHub: https://github.com/unikraft/unikraft https://github.com/unikraft/unikraft * Twitter: https://twitter.com/UnikraftSDK https://twitter.com/UnikraftSDK * LinkedIn: https://linkedin.com/company/unikraft-sdk https://linkedin.com/company/unikraft-sdk

filleokus 5y ago

Oh, this looks really cool! I was just research the other day how I could make a RPI running some simple LED-blinking app boot as fast as possible, this looks quite much faster than trying to strip down linux. For someone who doesn't know that much about unikernels, is it possible (or a good idea) to run a multi threaded / multi process application on there? I'm thinking of something like a python app + nginx reverse proxy, or a Go App using the built in http server?

felipehuici 5y ago
Hey, yes, you could and in some cases it might make sense (e.g., you need to do some packet processing as one app but you also want the control plane as another app in the same unikernel). Generally speaking unikernels have a single memory address space so don't support (or don't easily support) processes, so the apps would run on separate threads.

anentropic 5y ago

Looks promising! How do you avoid problem of creating a unikernel that appears to work, until you exercise some different code path at runtime that needs some modular OS feature you didn't think to include in the unikernel? (I have no idea if this is a real problem, just seemed like it could be from skim reading the basics)

halation_effect 5y ago
You could try fuzzing. But, if you do not include a modular OS feature(e.g network stack), the unikernel would not compile since it's missing symbols.
- felipehuici 5y ago
  Yes, that's right. If you do not include a module that could potentially be used, you'd be missing that symbol and it would not compile.
  - anentropic 5y ago
    Ah good point, thanks

yawaramin 5y ago

How does this differ from MirageOS? ( https://mirage.io/ https://mirage.io/ )

halation_effect 5y ago
From the paper: "MirageOS [40] is an OCaml-specific unikernel focusing on type-safety, so does not support mainstream applications, and its performance, as shown in our evaluation, is sub-par with respect to other unikernel projects"
chubot 5y ago
Our evaluation using off-the-shelf applications such as nginx, SQLite, and Redis shows that running them on Unikraft results in a 1.7x-2.7x performance improvement compared to Linux guests AFAIK MirageOS only supports OCaml and thus not any of those applications. That is an intentional design decision to get dead code elimination, global program optimization, etc. (And FWIW I think "monoglot" OSes are a mistake for this reason; Unix is polyglot and that's a feature, not a bug. Even in contexts where a unikernel would make sense, you may need to inspect the node dynamically.)
- skuenzer 5y ago
  It is true that MirageOS has its focus on OCaml as a type-safe language. Its libraries are implemented in OCaml. However, even with having most parts written in C in Unikraft, we are also able to apply dead-code elimination and link-time optimizations with the compiler. In principle you should even be able to combine libraries that are written with different languages. Regarding inspecting: The design does not exclude that you could add libraries to enable inspection and monitoring. We are even thinking that this is quite important for today deployments: Imagine an integration with Prometheus or a little embedded SSH shell. The difference to Unix and what we want to achieve is to utilize specialization. Unix/Linux/etc. are general purpose OSes, that are very good fits for cases where you do not know beforehand which applications you are going to run on it (e.g., end-devices like desktops, smartphones). Unikraft wants to optimize the cases where you know beforehand what you are going to run on it and where you are going to run it. It is optimizing the kernel layers and optionally also the application for the use case.

ncmncm 5y ago

This approach competes with an easier and more widely used method of running a regular process on an "isolated core", and using "kernel bypass" libraries. On such a system, the process starts up with full access to system resources while it reads config files, allocates, maps, and initializes memory, and sets up devices, and then enters its main loop where it operates solely on memory-mapped buffers and, possibly, I/O registers, running with no system calls or interruptions by the OS, potentially for months after. For example, it might use an OpenOnload library to watch a ring buffer being pushed packets by a NIC via DMA, processing the packets as they appear and updating a mapped/shared memory region with the results. It might, further, construct packet images based on its results, or what it finds in memory mapped from another process, and use the same library to trigger the NIC to send the packet images. Regular, scheduled processes may watch the mapped memory and do less timing-constrained work, such as logging events, performing file system operations, or even operating a UI, and maybe queue requests into more mapped memory polled by the isolated process. This mode of operation is quite common at high-speed stock trading firms, or to control specialized equipment with stringent timing requirements, without need to deploy a realtime OS. Usually these systems make heavy use of ring buffers to keep processes decoupled, placed in "hugetlb" 2MB-sized memory pages to minimize or even eliminate memory-map cache contention, by mapping files in /dev/hugepages. All the regular system facilities still work. The program is built with the ordinary linker. You can attach your regular debugger to the process, at startup or after it has been running for a month.