Climbing out from the digital mud with unikernels
summary
Claims that tiny VMs stop common attacks by default and remove shells from servers are central: no shell, one process per VM limits RCE and shrinks attack surface from millions of lines to tens of thousands. Tooling and projects named include solo five, micro KVM, light VM and a demo tool virgo (github.com/deferpanic/virgo). Reported metrics: 10–20 MB images, boot times as low as 2.3 ms, 10,000 unikernels per commodity server, and real deployments (Rust on ARM for oil rigs, NFV, on‑prem biotech).
AI-written summary · about
chapters (27)
- 0:00Introduction and welcome
- 1:08Problems with monolithic OS design
- 3:34History of software development
- 6:20What is an OS and an application?
- 7:23Security risks and past exploits
- 10:59Equifax breach and its implications
- 11:41The future with unikernels
- 12:22What are unikernels?
- 14:29Real-world use cases
- 15:55Notable unikernel projects
- 17:20Demo and practical examples
- 19:53Q&A: Unikernels vs Docker
- 22:30Q&A: Running in production
- 23:33Q&A: System calls provided
- 25:18Q&A: Performance benefits
- 26:43Q&A: Single-process limitations
- 28:11Q&A: File systems in unikernels
- 29:13Q&A: Pure vs POSIX unikernels
- 30:24Q&A: Rump kernel background
- 31:56Q&A: Managing VMs and unikernels
- 33:20Q&A: Oil platform example
- 34:44Q&A: ARM and IoT applications
- 35:28Q&A: Orchestration differences
- 38:41Q&A: Java and unikernels
- 39:30Q&A: Future standards
- 40:58Q&A: Live demo attempt
- 42:17Summary and closing
related talks
25mUnikernels and why they're useful (or not)
30mBeyond Orchestration: The Cloud Native Runtimes Ecosystem for Performance and Security
22mThe Irresistible Rise of Cloud Native: What the Future Means for YOU
27mServerless MicroVMs for Containerized Applications
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
38mSecure Containers in Embedded Deployments
41mCloud Computing with KVM
33mlibkrun: KVM-based isolation for your workloads