2017 jan-19 meetup-unikernels
TRANSCRIPT
Thenextbiglittlething?
DockerGrenobleMeetup,19Jan2017
MikeBright, @mjbright
@mjbright
ViktorFarcic,seniorconsultantatCloudBees
...Oneofthemostexcitingareasthatwillbecomeprominentin2017willbeunikernels.
Whilethemajorityoftheindustryisstilltryingtowraptheirheadsaroundcontainers,wewillstartseeingunikernelstakingoverthestage.
Theywill,inaway,unifyfunctionalitiesprovidedbyVMsandcontainers.
http://sdtimes.com/whats-horizon-2017/
WhatareUnikernels?
Howdidwegethere?
Unikernelimplementations
CleanSlatePOSIXcompatibleTools
Future
Resources
Unikernels-Overview
@mjbright
WhatareUnikernels?"LibraryOS"UnikernelsareapplicationsimagesbuiltwithonlytheOperatingSystem
componentstheyactuallyrequire,e.g.TCPStack,Diskaccess.
Singleprocessapplications(nothreads,forkingormulti-user)withverysmallsize->highperformance,fastbootandsmallattacksurface(secure).
@mjbright
"LibraryOSes"
AUnikernelisbuiltbythecompilerlinkingonlytheOScomponentsneededbytheapplication.
TheOSbecomesa"LibraryOS"
Unlike"normal"applicationswhichsitatopagenericmonolithicLinuxkernel(orevenμ-kernel)whichhasmanyunneededfeatures,e.g.floppydriver.
WhatareUnikernels-howdidwegethere?
"LibraryOSes"Unneededfeaturesconsumeresourcesunnecessarily.
Unneededlegacyfeaturesrepresentasecurityrisk-especiallyinthecloud.
WhatareUnikernels-howdidwegethere?
"LibraryOSes"Unneededfeaturesconsumeresourcesunnecessarily.
Unneededlegacyfeaturesrepresentasecurityrisk-especiallyinthecloud.
AtOctober's"DockerDistributedSummit",DockereventalkedofminimizingtheHypervisoralso.
"UnikernelsTheriseofthelibraryhypervisorinMirageOS"
(ACM:Unikernels:RiseoftheVirtualLibraryOperatingSystem,Jan2014)
WhatareUnikernels-howdidwegethere?
"LibraryOSes"Unneededfeaturesconsumeresourcesunnecessarily.
Unneededlegacyfeaturesrepresentasecurityrisk-especiallyinthecloud.
AtOctober's"DockerDistributedSummit",DockereventalkedofminimizingtheHypervisoralso.
"UnikernelsTheriseofthelibraryhypervisorinMirageOS"
(ACM:Unikernels:RiseoftheVirtualLibraryOperatingSystem,Jan2014)
Theseminimalsystemscantake~200msectoboot.
Thisopensupthepossibilityofservicesbeingspinupondemand(MirageOSjitsu).
WhatareUnikernels-howdidwegethere?
"LibraryOSes"Applicationdomains
Cloud,e.g.serverless
IoT(Embedded)
HPC
NFV( UnikernelsmeetNFVEricssonResearch)
WherewillUnikernelsbeused?
"LibraryOSes"Applicationdomains
Cloud,e.g.serverless
IoT(Embedded)
HPC
NFV( UnikernelsmeetNFVEricssonResearch)
FromtheNFVContainersWhitePaper(2.3.Unikernels):
Unikernelsareessentiallysingle-applicationvirtualmachinesbasedonminimalisticOSes.SuchminimalisticOSeshaveminimumoverheadandaretypicallysingle-addressspace(sonouser/kernelspacedivideandnoexpensivesystemcalls)andhaveaco-operativescheduler(soreducingcontextswitchcosts).
ExamplesofsuchminimalisticOSesareMiniOS[MINIOS]whichrunsonXenandOSv[OSV]whichrunsonKVM,XenandVMWare.
https://datatracker.ietf.org/doc/draft-natarajan-nfvrg-containers-for-nfv/?include_text=1
WherewillUnikernelsbeused?
@mjbright
UnikernelFamilies ManyUnikernelimplementationsexist,therearetwo
mainclassesofUnikernels
Unikernelimplementations
UnikernelFamilies ManyUnikernelimplementationsexist,therearetwo
mainclassesofUnikernels
Sometakeaclean-slateapproachandemphasizesafetyandsecurity.ThesetendtousethesamelanguagefortheapplicationandtheLibraryOScomponents.
MirageOS(Ocaml)HalVM(Haskell)
Unikernelimplementations
UnikernelFamilies ManyUnikernelimplementationsexist,therearetwo
mainclassesofUnikernels
Sometakeaclean-slateapproachandemphasizesafetyandsecurity.ThesetendtousethesamelanguagefortheapplicationandtheLibraryOScomponents.
MirageOS(Ocaml)HalVM(Haskell)
OthersfavourbackwardcompatibilityofexistingapplicationsbasedonPOSIX-compatibility.
Manyapplicationshavebeenported
OSv(Tomcat,Jetty,Cassandra,OpenJDK,...)Rumprun(MySQL,PHP,Nginx)
Unikernelimplementations
UnikernelImplementationsTechnology Description
ClickOScnp.neclab.eu
Forembeddednetworkh/w.~5MBimages,boots<20ms,45μsdelay,100VMs=>10Gbps
Clivelsub.org
WritteninGo.Fordistributedandcloud.
DrawbridgeMS
Researchprototype.Picoprocess/containerwithminimalkernelAPIsurface,andWindowslibraryOS.
Graphenegraphene
Securing"multi-process"legacyapps-addsIPC.
HaLVMgalois.com
PortofGHC(GlasgowHaskellCompiler)suite.WriteappsinHaskelltorunonXen.
IncludeOSincludeos.org
ResearchprojectforC++codeonvirtualhardware.
LINGerlangonxen.org
Erlang/OTPrunsonXen.
MirageOSmirage.io
Clean-slatelibraryOSforsecure,high-perfnetworkapps.Morethan100MirageOSlibrariesplusOCamlecosystem.
OSvosv.ioCloudius
RunLinuxbinaries(w.limitations),supportsC/C++,JVM,Ruby,Node.js
Rumprunrumpkernel.org
FreeBSD-RunsPOSIXs/wonBMorVM(Xen).
Clean-Slate
https://mirage.io/
OCaml-Based
MirageOS"LibraryOS"componentsarewritteninOcaml.
ML-derivedlanguagesarebestknownfortheirstatictypesystemsandtype-inferringcompilers.
OCamlunifiesfunctional,imperative,andobject-orientedprogrammingunderanML-liketypesystem.
OCamlhasextensivelibrariesavailable
(Unisonutility)
Unikernelimplementations-MirageOS/Ocaml
Clean-Slate
https://mirage.io/
OCaml-Based
MirageOSUnikernelsarebasedontheMirage-OSUnikernelbase(OSlibrary).
ThemiragetoolisusedtobuildUnikernelsforvariousbackends:
XenHypervisor(PV)Unix(LinuxorOS/Xbinaries)Browser(viaOcaml->JScompiler!!)EvenanexperimentalBMbackendforRaspberryPi
Unikernelimplementations-MirageOS-2
Clean-Slate
https://mirage.io/
OCaml-Based
MirageOSUnikernelsarebasedontheMirage-OSUnikernelbase(OSlibrary).
ThemiragetoolisusedtobuildUnikernelsforvariousbackends:
XenHypervisor(PV)Unix(LinuxorOS/Xbinaries)Browser(viaOcaml->JScompiler!!)EvenanexperimentalBMbackendforRaspberryPi
Buildingapplicationsforunixorxen
mirageconfigure-tunixmake./mir-console
mirageconfigure-txenmake****xencreate./mir-console.xen
Unikernelimplementations-MirageOS-2
@mjbright
Clean-Slate
https://mirage.io/
BNCPinata:http://ownme.ipredator.se/
Networkingapplications
e.g.CyberChaff"falsenetworkhosts"
PayGarden,SeanGrove
"Babystepstounikernelsinproduction"
Toopainfultocreate/configureAMIimagesonAWSSolo5allowstocreateKVMimagesdeployableonGCE
Unikernelimplementations-MirageOS-UseCases
@mjbright
Clean-Slate
HalVM-TheHaskellLightweightVirtualMachine:GHCrunningonXen
https://github.com/GaloisInc/HaLVM
HalVM3isreconsideringit'sUnikernelbasehttp://uhsure.com/halvm3.html
Userumpkernel(NetBSDbase)ShifttoSolo5?
Unikernelimplementations-HalVM
@mjbright
POSIX-based
http://osv.iohttp://blog.osv.io
OSv-CapableofrunningPOSIXbinaries
canrunJVMCassandra:https://www.penninkhof.com/2015/05/minimalist-cassandra-vm-using-osv/
UsedinMikelangelo(EUProject)TheMIKELANGELOprojectaimstobringHighPerformanceComputing(HPC)tothecloud.HPCtraditionallyinvolvesbleedingedgetechnologies,includinglotsofCPUcores,Infinibandinterconnectsbetweennodes,MPIlibrariesformessagepassing,and,surprise—NFS,averyoldtimeroftheUNIXuniverse.
BuildingOSvImagesUsingDocker:http://blog.osv.io/blog/blog/2015/04/27/docker/
SDI:ODL+OSv:http://blog.osv.io/blog/blog/2015/03/31/sdi/
Unikernelimplementations-OSv
@mjbright
ToolsUnik:toolforcompilingappstounikernels(varioustechnologies)
Solo5:Analternativeunikernel-baseforMirageOS
Providesqemu/KVMsupportforMirageOS
ukvm:AnalternativeVMMonitor
a"libraryhypervisor"
capstan:OSvbuildtool
UnikernelTools
@mjbright
Clean-SlateMirageOSjitsu:"Just-In-TimeSummoningofUnikernels"
ADNSserverthatstartsunikernelsondemand.
TestedwithMirageOSandRumprununikernels.
https://github.com/mirage/jitsu
UnikernelTools
@mjbright
UnikernelsorContainers? SowhathasthisgottodowithContainers?
WhydidDockerbuyUnikernelSystems(Jan2016)?
Info.Q/Amir,Aug2016
UnikernelsandContainers
UnikernelsorContainers? SowhathasthisgottodowithContainers?
WhydidDockerbuyUnikernelSystems(Jan2016)?
Info.Q/Amir,Aug2016
UnikernelSystemsareinvolvedinMirageOS/XenUseofUnikernelsinDockerforMac
VPNKit,DataKitToprovidebuild/run/shiptoolsforUnikernels?TosecureContainerdeployments
RunningUnikernelsincontainers????Securefront-endsinhybridsolutionsmadeofunikernelsandcontainers
e.g.forOCamlMediaWiki(http2https,tls,...)
UnikernelsandContainers
@mjbright
Demo
ResourcesScoop.it
Unikernelswww.scoop.it/t/unikernels
Wikipedia en.wikipedia.org/wiki/Unikernel
unikernels.org unikernels.org
mirageos.iomirageos.io
mirage.io/docs/papers
OReilly"Unikernels"
Freedownload
@unikernel @unikernel
github.com/ocamllabs ocamllabs
github.com/mirage MirageOS
@mjbright
ThankyouQ&A