Applying the unikernel concept to more applications

Posted Sep 1, 2014 19:36 UTC (Mon) by ibukanov (subscriber, #3942)
In reply to: Applying the unikernel concept to more applications by dmarti
Parent article: Containers vs Hypervisors: The Battle Has Just Begun (Linux.com)

This makes OSv rather similar in porting level and isolation as with Google Native Client. However, with NaCl one can still update the system without touching the executable while, as I can see, OSv requires rebuilding of all executables after a security update in, say, networking code.

Applying the unikernel concept to more applications

Posted Sep 1, 2014 23:37 UTC (Mon) by dmarti (subscriber, #11625) [Link] (2 responses)

Yes, you do have to rebuild your OSv VMs if you update one of the third-party libraries you use.

OSv will use some libraries built for a Linux host (such as libevent in the HTTP server example above) so you may not have to do a separate build just for your OSv systems, and simply use the library from your Linux environment of choice.

I don't know if it's meaningful to say that OSv isolation level is similar to that of NaCl. Both of them definitely have the goal of strict isolation, but they approach it in totally different ways: NaCl by forcing you to use a safe subset of valid x86_64 code, and OSv by using the hypervisor/guest kernel barrier.

Applying the unikernel concept to more applications

Posted Sep 2, 2014 5:45 UTC (Tue) by ibukanov (subscriber, #3942) [Link] (1 responses)

By having networking and other parts of OS available as an application library without memory protection OSv increases an attack surface compared with heavyweight solution like running both the kernel and the application under the hypervisor. Due to shared memory space a bug in application could lead to an exploit affecting both low level storage and networking implementation. For many cases this would be enough for the attacker.

However, this situation is still much better than a typical setup for Linux containers where a bug in a big and fat Linux kernel allows to take the whole system. And I suppose OSv can archive the same if not better performance than container solutions.

What is interesting about NaCl is that it provides the same level of isolation as one gets using memory protection under normal OS with much cheaper system calls. They are still more expensive than function calls, but the performance toll should be small enough not to worry about it. So it would be interesting to port NaCL to OSv to get both performance of a lightweight VM and isolation one gets using using a memory-protected kernel for system services.

Applying the unikernel concept to more applications

Posted Sep 5, 2014 9:35 UTC (Fri) by justincormack (subscriber, #70439) [Link]

I think part of the OSv model is to use the JVM bytecode validation as the "NaCl" validation layer, from memory.