Further, you have less to lose if that surface is breached; If you penetrate a unikernel static content server, you can't really do much on that system; It won'

Further, you have less to lose if that surface is breached; If you penetrate a unikernel static content server, you can't really do much on that system; It won't have a shell, compilers, or any of the tooling needed to expand that hole. Because your OS is so much simpler, the cleanup is simpler too; Nuking the machine and starting over is much simpler when you've designed for lightweight unikernels.