7 ms·

Introduction to Unikernel: Building, deploying lightweight, secure applications

42 points by eyberg 1y ago

perbu 1y ago
Unikernels are quite an intriguing concept. They'll be re-discovered every five years, like programmers keep re-discovering functional programming.
- burnt-resistor 1y ago
  They're flying cars and VR. People eventually come to realize they're not so great when having to apply real-world, cross-cutting concerns like access control, audit, logging, debugging, profiling, monitoring, throttling, backup, and recovery. The emperor's new clothes might have a hole or two in them.
  - phendrenad2 1y ago
    It seems that way because people are stuck thinking in terms of an operating system. Need access control? Put a file on the server. Need auditing? Log into the server. Need logging? A text file... on the server. None of these need be done this way, and in fact ways that make sense when you have a full operating system don't make sense with a unikernel. Hint: All of these things should be database-driven.
  - eyberg 1y ago
    Access Control: There is none internally. We don't have the notion of users. Logging: Keep using whatever you want be it elasticsearch, syslog, cloudwatch, etc. No opinions here. Debugging: GDB works fine and in many cases since you can simply export the vm in it's entirety and then attach to it locally this becomes even easier to debug than the same application running on linux. Profiling: We support things like ftrace and of course things like prometheus you can export. Monitoring: Kinda in the same boat as logging - keep using whatever you are using today - datadog, victoria metrics, etc. Throttling: This is traditionally an app-level concern that someone would implement at perhaps a load balancing layer - keep using whatever you are using. Backup/Recovery: Running unikernels make it trivial to backup as you can clone running vms. In fact most cloud deploys involve making a snapshot that is already stored as a 'backup' and makes things like rollback much easier to do.
    - burnt-resistor 1y ago
      Unikernels lack infrastructure to do any of these. That's why they're self-defeating canards.
      - eyberg 1y ago
        I'm not sure what your comment means? What infrastructure? I just broke apart each of those into examples of how people use them today.
        burnt-resistor 1y ago
        Command line. Packages. Mounts. File systems. Any standard anything. There's nothing unless you reinvent the wheel. Standardization and repeatability allow reuse of the work of many others. Unikernels throw 99.99% of it away.
        eyberg 1y ago
        Packages exist: https://repo.ops.city https://repo.ops.city Mounts also exist - in fact you can hotplug volumes on the fly on all the major clouds. People really like this cause they can do things like rotate ssl certs every few hours. The file system exists - at the very least you need to load a program that sits on the filesystem but people are running webservers that write to temp files and load static assets and also databases.
wiradikusuma 1y ago
Wake me up when you can unikernel-ize a Java framework like Quarkus or Spring.
- eyberg 1y ago
  https://github.com/nanovms/ops-examples/tree/master/java/04-quarkus https://github.com/nanovms/ops-examples/tree/master/java/04-...
- rwmj 1y ago
  Running Java applications was the original mission of OSv (https://osv.io/ https://osv.io/). Reading the website now they seem to have pivoted to running unmodified Linux applications.
  - eyberg 1y ago
    The rabbit hole goes even deeper. Georgios was thinking about this with Jikes even earlier: https://gousios.org/pub/gousios-mscthesis.pdf https://gousios.org/pub/gousios-mscthesis.pdf
  - wiradikusuma 1y ago
    Does it mean it can run Java compiled to Native Image?
    - eyberg 1y ago
      It doesn't necessarily mean that but yes you most definitely can run native images - another example showing that: https://github.com/nanovms/ops-examples/tree/master/java/07-graalvm https://github.com/nanovms/ops-examples/tree/master/java/07-... . Both of these pair very well with unikernels. Especially quarkus has excellent boot time and low mem usage.
    - DmitryOlshansky 1y ago
      Why not full VM with JIT? Seems much easier and more compatible with apps out there.
pixelnomad 1y ago
[dead]
tuananh 1y ago
@eyberg: i'm curious on how NanosVM Inception works? what's included in the image here https://aws.amazon.com/marketplace/pp/prodview-lwk72eg6wfo3i https://aws.amazon.com/marketplace/pp/prodview-lwk72eg6wfo3i
- eyberg 1y ago
  Sorry - just now seeing this. This is a build of PVM that works with Nanos. We're also maintaining that patch set as I don't ever see it getting included into the kernel (not anytime soon anyways).
alrs 1y ago
Undead, undead, undead.

42 points by eyberg 1y ago

Unikernels are quite an intriguing concept. They'll be re-discovered every five years, like programmers keep re-discovering functional programming.

burnt-resistor 1y ago
They're flying cars and VR. People eventually come to realize they're not so great when having to apply real-world, cross-cutting concerns like access control, audit, logging, debugging, profiling, monitoring, throttling, backup, and recovery. The emperor's new clothes might have a hole or two in them.
- phendrenad2 1y ago
  It seems that way because people are stuck thinking in terms of an operating system. Need access control? Put a file on the server. Need auditing? Log into the server. Need logging? A text file... on the server. None of these need be done this way, and in fact ways that make sense when you have a full operating system don't make sense with a unikernel. Hint: All of these things should be database-driven.
- eyberg 1y ago
  Access Control: There is none internally. We don't have the notion of users. Logging: Keep using whatever you want be it elasticsearch, syslog, cloudwatch, etc. No opinions here. Debugging: GDB works fine and in many cases since you can simply export the vm in it's entirety and then attach to it locally this becomes even easier to debug than the same application running on linux. Profiling: We support things like ftrace and of course things like prometheus you can export. Monitoring: Kinda in the same boat as logging - keep using whatever you are using today - datadog, victoria metrics, etc. Throttling: This is traditionally an app-level concern that someone would implement at perhaps a load balancing layer - keep using whatever you are using. Backup/Recovery: Running unikernels make it trivial to backup as you can clone running vms. In fact most cloud deploys involve making a snapshot that is already stored as a 'backup' and makes things like rollback much easier to do.
  - burnt-resistor 1y ago
    Unikernels lack infrastructure to do any of these. That's why they're self-defeating canards.
    - eyberg 1y ago
      I'm not sure what your comment means? What infrastructure? I just broke apart each of those into examples of how people use them today.
      - burnt-resistor 1y ago
        Command line. Packages. Mounts. File systems. Any standard anything. There's nothing unless you reinvent the wheel. Standardization and repeatability allow reuse of the work of many others. Unikernels throw 99.99% of it away.
        eyberg 1y ago
        Packages exist: https://repo.ops.city https://repo.ops.city Mounts also exist - in fact you can hotplug volumes on the fly on all the major clouds. People really like this cause they can do things like rotate ssl certs every few hours. The file system exists - at the very least you need to load a program that sits on the filesystem but people are running webservers that write to temp files and load static assets and also databases.

wiradikusuma 1y ago

Wake me up when you can unikernel-ize a Java framework like Quarkus or Spring.

eyberg 1y ago
https://github.com/nanovms/ops-examples/tree/master/java/04-quarkus https://github.com/nanovms/ops-examples/tree/master/java/04-...
rwmj 1y ago
Running Java applications was the original mission of OSv (https://osv.io/ https://osv.io/). Reading the website now they seem to have pivoted to running unmodified Linux applications.
- eyberg 1y ago
  The rabbit hole goes even deeper. Georgios was thinking about this with Jikes even earlier: https://gousios.org/pub/gousios-mscthesis.pdf https://gousios.org/pub/gousios-mscthesis.pdf
- wiradikusuma 1y ago
  Does it mean it can run Java compiled to Native Image?
  - eyberg 1y ago
    It doesn't necessarily mean that but yes you most definitely can run native images - another example showing that: https://github.com/nanovms/ops-examples/tree/master/java/07-graalvm https://github.com/nanovms/ops-examples/tree/master/java/07-... . Both of these pair very well with unikernels. Especially quarkus has excellent boot time and low mem usage.
  - DmitryOlshansky 1y ago
    Why not full VM with JIT? Seems much easier and more compatible with apps out there.

pixelnomad 1y ago

[dead]

tuananh 1y ago

@eyberg: i'm curious on how NanosVM Inception works? what's included in the image here https://aws.amazon.com/marketplace/pp/prodview-lwk72eg6wfo3i https://aws.amazon.com/marketplace/pp/prodview-lwk72eg6wfo3i

eyberg 1y ago
Sorry - just now seeing this. This is a build of PVM that works with Nanos. We're also maintaining that patch set as I don't ever see it getting included into the kernel (not anytime soon anyways).

alrs 1y ago

Undead, undead, undead.