paper

Unikernels as Processes

  • Authors:
Read the paper

📜 Abstract

System virtualization (e.g., the virtual machine abstraction) has been established as the de facto standard form of isolation in multi-tenant clouds. More recently, unikernels have emerged as a way to reuse VM isolation while also being lightweight by eliminating the general purpose OS (e.g., Linux) from the VM. Instead, unikernels directly run the application (linked with a library OS) on the virtual hardware. In this paper, we show that unikernels do not actually require a virtual hardware abstraction, but can achieve similar levels of isolation when running as processes by leveraging existing kernel system call whitelisting mechanisms. Moreover, we show that running unikernels as processes reduces hardware requirements, enables the use of standard process debugging and management tooling, and improves the already impressive performance that unikernels exhibit.

✨ Summary

The paper presents a process-based execution model for unikernels in which a restricted “tender” process replaces the virtual-machine monitor. Using system-call whitelisting, specifically Linux seccomp, the prototype—called nabla—maps the unikernel’s narrow hypercall interface to a correspondingly narrow host system-call interface. The evaluation reports fewer host-kernel interactions, a 98% reduction in accessible kernel functions relative to an unrestricted process, up to 245% higher throughput, up to 73% shorter startup time, and 20% greater memory density compared with the virtualized execution model.

The work subsequently informed software projects built around the same design. The Solo5 project introduced the spt sandboxed-process target for running Solo5-based unikernels as user processes under strict seccomp-BPF isolation, while Nabla Containers applied Solo5-based library-OS techniques to container isolation. These developments provide concrete evidence that the paper’s process-based unikernel model influenced subsequent unikernel tooling and container-runtime research and development. (people.cs.vt.edu)