A unikernel is a type of computer program that is statically linked with the operating system code on which it depends. Unikernels are built with a specialized compiler that identifies the operating system services that a program uses and links it with one or more library operating systems that provide them. Such a program requires no separate operating system and can run instead as the guest of a hypervisor.
Background and Origins
The unikernel architecture builds on concepts developed by Exokernel and Nemesis in the late 1990s. In a library operating system, protection boundaries are pushed to the lowest hardware layers, resulting in: (1) a set of libraries that implement mechanisms such as those needed to drive hardware or handle network protocols; and (2) a set of policies that enforce access control and isolation in the application layer.
Architecture and Design
A unikernel compiles application code together with only the minimal operating system components it requires—such as device drivers, network stack, and memory management—into a single, lightweight binary image. This image runs directly on a hypervisor (such as Xen or KVM) or on bare metal, without a traditional general-purpose operating system layer.
Because there is only a single address space, there is no need for repeated privilege transitions to move data between user space and kernel space. This can provide improved performance by allowing direct access to hardware without transitioning between user mode and kernel mode. Performance gains may also be realized by eliminating the need to copy data between user space and kernel space.
Advantages
- Reduced Attack Surface: By reducing the amount of code deployed, unikernels necessarily reduce the likely attack surface, which can improve security properties.
- Small Footprint: Unikernel images are often orders of magnitude smaller than traditional OS deployments. An example unikernel-based messaging client has roughly 4% the size of equivalent code bases using Linux.
- Fast Boot Times: Unikernels have been regularly shown to boot extremely quickly, sometimes in time to respond to incoming requests before those requests time out.
- Whole-System Optimization: Due to their construction, it is possible to perform whole-system optimization across device drivers and application logic.
- Performance: Off-the-shelf applications such as nginx, SQLite, and Redis running over a unikernel have shown performance improvements of approximately 1.7x to 2.7x.
Disadvantages and Limitations
- No Multi-Application Isolation: Because there is no separation of user space and kernel space, running multiple applications side by side with strong resource isolation becomes complex.
- Hardware Driver Burden: Device drivers are required for the specific hardware the library OS runs on. Since hardware changes rapidly, this creates a burden of regularly rewriting drivers.
- Not Suitable for General-Purpose Computing: Unikernels are unsuitable for general-purpose, multi-user computing due to their high degree of specialization.
- Static Compilation: Adding additional functionality or altering a compiled unikernel is generally not possible. Instead, a new unikernel must be compiled and deployed with the desired changes.
Use in Modern Architectures
Unikernels lend themselves to creating systems that follow service-oriented or microservices software architectures. A modern hypervisor provides virtual machines with CPU time and strongly isolated virtual devices; a library OS running as a virtual machine only needs to implement drivers for these stable virtual hardware devices and can depend on the hypervisor to drive the real physical hardware.
Related Concepts
- Microkernel
- Containerization (computing)
- Rump kernel
- IncludeOS
