In this presentation Tomek Kalinowski introduces the Audience to the idea of “Library Operating System” and its modern extension - The Unikernel. In short unikernel is another way of packaging and deploying code in which everything, including operating system, is tailored to serve your code’s single purpose (like displaying random cat pictures). We'll try to answer the questions: - Why and when it can be useful? - Is this reusable? Interoperable? - How we can leverage virtualization? And last, but not least, is this the answer for inevitable coming of our Lord and Savior FPGA?

1. Unikernels
Keep It Simple – To The Bare Metal

2. 2

3. 3
Agenda
●
What is it?
●
The hypervizor
●
Library OS
●
MirageOS and IncludeOS
●
Making your own
●
Beyond experimentation
●
Notable examples
●
Questions?

4. 4
What is Unikernel?
●
Specialized OS
– Serves one purpose
– Compiled into small, standalone kernel
– You Get Only What You Need
– Created with cloud in mind
●
Single address space
– Single process
– No kernel/user mode switch
– Single ring
– Doesn’t mean separation cannot be enforced
– Can be immutable
●
Embedded configuration
●
Prepared for hypervizor
– True virtual machines
●
Can be packaged into
– Binary
– Image
– ...or transpiled

5. 5
Specialized
* Unikernels: Library Operating Systems for the Cloud, 2013, Madhavapeddy, Mortier, et al

6. 6
* ripped from IncludeOS demo
True virtualization
Hardware
Hypervizor VM1 VM2 VM3 VM4 VM5
trap

7. 7
Library OS
Operating system is your framework.
Library OS is a set of libraries.

8. 8
Library OS - Exokernel approach
* image source: Wikipedia
Monolithic kernel compared to exokernel
●
Apps can talk to hardware directly
●
Libraries provide abstractions over
hardware
●
It is up to app designers to decide
how they want to consume hardware
resources
●
Small kernel manages separation of
memory, CPU time, disk storage

9. 9
MirageOS
●
Follows Exokernel pattern
●
Implemented in OCaml (and some C)
●
Multiple backends
●
Can yield great results in terms of
image size, memory usage, boot time
●
You write everything in OCaml
●
Works with Xen

10. 10
OCaml modules
amodule.ml
let hello () = print_endline "Hello"
bmodule.ml
Amodule.hello ()
Every file is a module

11. 11
OCaml modules
amodule.ml
let message = "Hello"
let hello () = print_endline message;;
bmodule.ml
Amodule.hello ()
Every file is a module

12. 12
OCaml modules
amodule.ml
let message = "Hello"
let hello () = print_endline message;;
amodule.mli
val hello : unit -> unit
Singatures

13. 13
OCaml modules
amodule.ml
let message = "Hello"
let hello () = print_endline message;;
amodule.mli
val hello : unit -> unit
Singatures Functors
module F (X : X_sig) = struct
...
end

14. 14
OCaml modules
amodule.ml
let message = "Hello"
let hello () = print_endline message;;
amodule.mli
val hello : unit -> unit
Singatures Functors
module F (X : X_sig) = struct
...
end
module Int_set = Set.Make (struct
type t = int
let compare = compare
end);;

15. 15
MirageOS – library OS realization
* Unikernels: Rise of the Virtual Library Operating System

16. 16
IncludeOS
●
C++ runtime
●
You literally #include<os>
●
No C layer, tru Unikernel man!
●
Everything in ring0
●
Single threaded, evented non-
blocking I/O

17. 17
Acorn
includeos/acorn
// Serve index.html on GET /
router.on_get("/",
[disk] (auto, auto res)
{
disk->fs().cstat("/index.html",
[res] (auto err, const auto& entry)
{
if(err)
res->send_code(http::Not_Found);
else
res->send_file({disk, entry});
});
});

18. 18
Briefly about security
●
No parent process
●
Stripped down to your needs
●
No shell to escape
●
Memory access can be immutable, sealed,
randomized
●
Whole application optimalization
●
Dead when not neaded
●
You rely on hypervizor
●
UDD

19. 19
Your own Unikernel
●
Get to know Xen
●
No, kernel is not the biggest challenge
●
It’s the protocols
●
(and drivers… maybe)
●
Understand your needs
●
It’s a challenge
●
Albeit fun one

20. 20
Beyond experimentation
●
Stability challenge
●
Orchestration challenge
●
Unikernel Systems bought by Docker
– Docker for Mac, HyperKit, VPNKit
– uKVM, Solo5
●
Unikernels in containers

21. 21
Others (unikernel.org/projects)
rump kernel
●
orchestration
●
JVM included
●
no bare metal●
NetBSD ABI and drivers
●
compiles to POSIX
●
bare-metal support
●
Xen support
ClickOS
●
network processing on commodity hardware
●
<buzzword>
●
6 MB instance image
●
10 Gb/s
●
boot time: 30 ms
●
latency: 45 µs
●
</buzzword>
●
build & orchestration tool
●
language unikernel→

22. 22
Resources
pastebin.com/3Ximjw5P

23. 23
Questions?