IncludeOS: a unikernel for C++ applications

The virtual machine itself really is just a special case application. The virtual machine is not 'emulated PC' anymore. There is no interpretation of cpu instructions going on. The application code running in a virtual machine is executing on the CPU just like any normal application. Just has a couple extra layers of memory address abstraction and whatnot.

Modern VMs depend heavily on paravirtualization to be efficient. They are aware of the cpu types and make all sorts of efforts to reduce software layers between applications and physical network and physical storage to as minimal as possible. As time goes on the VM becomes more and more aware that it is a VM.

So what we end up with is really much closer to Java virtual machines then anything else. Major difference is that instead of executing Java bytecode they use x86_64 machine code.

After all this really isn't that much different then the same sort of transition that happened when you went from 'single user' application environments like a DOS.. which was little more then a fancy program loader.. to multi-user multi-process environments. Throw in some memory address abstractions and there you go.

And if a attacker is able to seize control of a virtual machine, which shouldn't be very difficult, then
it's not much more difficult to attack the hosting system then it is if you took over any other userland process like Firefox. If you want substantial improvements in security you are still going to need to depend on available DAC and MAC controls in the host OS to aid in the natural sort 'sandboxing' that VMs offer.

All these things... running virtual machines, containers, or executing applications... really should be thought of as pretty much the same things. There isn't a really good reason, other then historical happenstance and tradition, why they are treated so differently.