2 ms·
I think another aspect I recall reading somewhere is security: if you can do the job with a far simpler system, potentially you end up with less attack surface
by shoo 11y ago
I think another aspect I recall reading somewhere is security: if you can do the job with a far simpler system, potentially you end up with less attack surface (assuming the fancy new simpler system is actually well built and tested, etc).
E.g.
> Why use Mirage OS?
>
> The cloud has so far mostly been used to
> consolidate existing operating systems and manage
> them more conveniently. The interface between
> guest kernels, applications and VMs are all
> managed very differently, leading to serious
> inefficiencies, unreliability and insecurity.
http://www.xenproject.org/developers/teams/mirage-os.html http://www.xenproject.org/developers/teams/mirage-os.html
https://mirage.io https://mirage.io
- GauntletWizard 11y agoFurther, you have less to lose if that surface is breached; If you penetrate a unikernel static content server, you can't really do much on that system; It won't have a shell, compilers, or any of the tooling needed to expand that hole. Because your OS is so much simpler, the cleanup is simpler too; Nuking the machine and starting over is much simpler when you've designed for lightweight unikernels.