research-article

Unikernels as Processes

Authors:

Ricardo Koller,

Nikhil PrakashAuthors Info & Claims

SoCC '18: Proceedings of the ACM Symposium on Cloud Computing

Pages 199 - 211

https://doi.org/10.1145/3267809.3267845

Published: 11 October 2018 Publication History

Abstract

System virtualization (e.g., the virtual machine abstraction) has been established as the de facto standard form of isolation in multi-tenant clouds. More recently, unikernels have emerged as a way to reuse VM isolation while also being lightweight by eliminating the general purpose OS (e.g., Linux) from the VM. Instead, unikernels directly run the application (linked with a library OS) on the virtual hardware. In this paper, we show that unikernels do not actually require a virtual hardware abstraction, but can achieve similar levels of isolation when running as processes by leveraging existing kernel system call whitelisting mechanisms. Moreover, we show that running unikernels as processes reduces hardware requirements, enables the use of standard process debugging and management tooling, and improves the already impressive performance that unikernels exhibit.

References

[1]

AWS Lambda. https://aws.amazon.com/lambda/. (Accessed on 2018-08-28).

[2]

Clive: Removing (most of) the software stack from the cloud. http://lsub.org/ls/clive.html. (Accessed on 2018-08-28).

[3]

Erlang on Xen. http://erlangonxen.org. (Accessed on 2018-08-28).

[4]

frankenlibc - tools for running rump unikernels in userspace. https://github.com/justincormack/frankenlibc. (Accessed on 2018-08-28).

[5]

ftrace - Function Tracer. https://www.kernel.org/doc/Documentation/trace/ftrace.txt. (Accessed on 2018-08-28).

[6]

gvisor - Container Runtime Sandbox. https://github.com/google/gvisor. (Accessed on 2018-08-28).

[7]

IBM Cloud functions. https://www.ibm.com/cloud/functions. (Accessed on 2018-08-28).

[8]

Kernel Samepage Merging. https://www.linux-kvm.org/page/KSM. (Accessed on 2018-08-28).

[9]

The rumprun unikernel and toolchain for various platforms. http://repo.rumpkernel.org/rumprun. (Accessed on 2018-08-28).

[10]

runtime.js - javascript library operating system for the cloud. http://runtimejs.org/. (Accessed on 2018-08-28).

[11]

Seccomp security profiles for Docker. https://docs.docker.com/engine/security/seccomp/. (Accessed on 2018-08-28).

[12]

Solo5 - A sandboxed execution environment for unikernels. https://github.com/solo5/solo5. (Accessed on 2018-08-28).

[13]

The Python Performance Benchmark Suite. http://pyperformance.readthedocs.io/. (Accessed on 2018-08-28).

[14]

Trinity - A Linux System call fuzz tester. http://codemonkey.org.uk/projects/trinity/. (Accessed on 2018-08-28).

[15]

Zerovm. http://www.zerovm.org/. (Accessed on 2018-08-28).

[16]

Barham, P., Dragovic, B., Fraser, K., Hand, S., Harris, T., Ho, A., Neugebauer, R., Pratt, I., and Warfield, A. Xen and the Art of Virtualization. In Proc. of ACM SOSP (Bolton Landing, NY, Oct. 2003).

Digital Library

[17]

Ben-Yehuda, M., Day, M. D., Dubitzky, Z., Factor, M., Har'El, N., Gordon, A., Liguori, A., Wasserman, O., and Yassour, B.-A. The turtles project: Design and implementation of nested virtualization. In Proc. of USENIX OSDI (Vancouver, BC, Canada, Oct. 2010).

Digital Library

[18]

Bratterud, A., Walla, A.-A., Haugerud, H., Engelstad, P. E., and Begnum, K. IncludeOS: A minimal, resource efficient unikernel for cloud services. In Proc. of IEEE CLOUDCOM (Vancouver, BC, Canada, Nov. 2015).

Digital Library

[19]

Cantrill, B. Unikernels are unfit for production. https://www.joyent.com/blog/unikernels-are-unfit-for-production, Jan. 2016. (Accessed on 2018-08-28).

[20]

Castro, M., Costa, M., Martin, J.-P., Peinado, M., Akritidis, P., Donnelly, A., Barham, P., and Black, R. Fast byte-granularity software fault isolation. In Proc. of ACM SOSP (Big Sky, MT, Oct. 2009).

Digital Library

[21]

Corbet, J. Securely renting out your CPU with Linux. https://lwn.net/Articles/120647/, Jan. 2005. (Accessed on 2018-08-28).

[22]

Dautenhahn, N., Kasampalis, T., Dietz, W., Criswell, J., and Adve, V. Nested kernel: An operating system architecture for intra-kernel privilege separation.

[23]

Dragoni, N., Giallorenzo, S., Lafuente, A. L., Mazzara, M., Montesi, F., Mustafin, R., and Safina, L. Microservices: Yesterday, Today, and Tomorrow. Springer International Publishing, Cham, 2017, pp. 195--216.

[24]

Edge, J. A seccomp overview. https://lwn.net/Articles/656307/, Sept. 2015. (Accessed on 2018-08-28).

[25]

Erlingsson, Ú., Abadi, M., Vrable, M., Budiu, M., and Necula, G. C. XFI: Software guards for system address spaces. In Proc. of USENIX OSDI (Seattle, WA, Nov. 2006).

Digital Library

[26]

Gupta, D., Lee, S., Vrable, M., Savage, S., Snoeren, A. C., Varghese, G., Voelker, G. M., and Vahdat, A. Difference engine: Harnessing memory redundancy in virtual machines. In Proc. of USENIX OSDI (San Diego, CA, Dec. 2008).

Digital Library

[27]

Kivity, A., Laor, D., Costa, G., Enberg, P., HarEl, N., Marti, D., and Zolotarov, V. OSv optimizing the operating system for virtual machines. In Proc. of USENIX Annual Technical Conf. (Philadelphia, PA, June 2014).

Digital Library

[28]

Kocher, P., Horn, J., Fogh, A., Genkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., Schwarz, M., and Yarom, Y. Spectre attacks: Exploiting speculative execution. In Proc. of IEEE Security and Privacy (San Francisco, CA, May 2019).

[29]

Koller, R., and Williams, D. Will serverless end the dominance of linux in the cloud? In Proc. of ACM/SIGOPS HotOS (Whistler, BC, Canada, May 2017).

Digital Library

[30]

Kurmus, A., Tartler, R., Dorneanu, D., Heinloth, B., Rothberg, V., Ruprecht, A., Schröder-Preikschat, W., Lohmann, D., and Kapitza, R. Attack surface metrics and automated compile-time os kernel tailoring. In Proc. of Internet Society NDSS (San Diego, CA, Feb. 2013).

[31]

Kurmus, A., and Zippel, R. A tale of two kernels: Towards ending kernel hardening wars with split kernel. In Proc. of ACM CCS (Nov. 2014).

Digital Library

[32]

Li, Y., Dolan-Gavitt, B., Weber, S., and Cappos, J. Lock-in-Pop: Securing privileged operating system kernels by keeping on the beaten path. In Proc. of USENIX Annual Technical Conf. (Santa Clara, CA, July 2017).

Digital Library

[33]

Lipp, M., Schwarz, M., Gruss, D., Prescher, T., Haas, W., Fogh, A., Horn, J., Mangard, S., Kocher, P., Genkin, D., Yarom, Y., and Hamburg, M. Meltdown: Reading kernel memory from user space. In Proc. of USENIX Security Symposium (Baltimore, MD, Aug. 2018).

Digital Library

[34]

Madhavapeddy, A., Mortier, R., Rotsos, C., Scott, D., Singh, B., Gazagnaire, T., Smith, S., Hand, S., and Crowcroft, J. Unikernels: Library operating systems for the cloud. In Proc. of ACM ASPLOS (Houston, TX, Mar. 2013).

Digital Library

[35]

Manco, F., Lupu, C., Schmidt, F., Mendes, J., Kuenzer, S., Sati, S., Yasukata, K., Raiciu, C., and Huici, F. My VM is lighter (and safer) than your container. In Proc. of ACM SOSP (Shanghai, China, Oct. 2017).

Digital Library

[36]

Martins, J., Ahmed, M., Raiciu, C., Olteanu, V., Honda, M., Bifulco, R., and Huici, F. ClickOS and the art of network function virtualization. In Proc. of USENIX NSDI (Seattle, WA, Apr. 2014).

Digital Library

[37]

McCabe, T. J. A complexity measure. IEEE Transactions on Software Engineering SE-2, 4 (Dec 1976), 308--320.

Digital Library

[38]

McCanne, S., and Jacobson, V. The BSD packet filter: A new architecture for user-level packet capture. In Proc. of Winter USENIX Conference (San Diego, CA, 1993).

Digital Library

[39]

OpenBSD. PLEDGE(2) - restrict system operations OpenBSD man page.

[40]

Porter, D. E., Boyd-Wickizer, S., Howell, J., Olinsky, R., and Hunt, G. C. Rethinking the library os from the top down. In Proc. of ACM ASPLOS (Newport Beach, CA, Mar. 2011).

Digital Library

[41]

Shi, L., Wu, Y., Xia, Y., Dautenhahn, N., Chen, H., Zang, B., Guan, H., and Li, J. Deconstructing xen. In Proc. of Internet Society NDSS (San Diego, CA, Feb. 2017).

[42]

Stengel, K., Schmaus, F., and Kapitza, R. Esseos: Haskell-based tailored services for the cloud. In Proc. of ACM/IFIP/USENIX ARM (Beijing, China, Dec. 2013).

Digital Library

[43]

Swift, M. M., Bershad, B. N., and Levy, H. M. Improving the Reliability of Commodity Operating Systems. ACM Transactions on Computer Systems 23, 1 (Feb. 2005), 77--110.

Digital Library

[44]

Thnes, J. Microservices. IEEE Software 32, 1 (Jan 2015), 116--116.

[45]

Waldspurger, C. A. Memory resource management in VMware ESX server. In Proc. of USENIX OSDI (Boston, MA, Dec. 2002).

Digital Library

[46]

Watson, R. N., Anderson, J., Laurie, B., and Kennaway, K. Capsicum: Practical capabilities for unix. In Proc. of USENIX Security Symposium (Washington, DC, Aug. 2010).

Digital Library

[47]

Williams, D., and Koller, R. Unikernel monitors: Extending minimalism outside of the box. In Proc. of USENIX HotCloud (Denver, CO, June 2016).

Digital Library

[48]

Williams, D., Koller, R., and Lum, B. Say goodbye to virtualization for a safter cloud. In Proc. of USENIX HotCloud (Boston, MA, July 2018).

Digital Library

[49]

Wu, C., Wang, Z., and Jiang, X. Taming hosted hypervisors with (mostly) deprivileged execution. In Proc. of Internet Society NDSS (San Diego, CA, Feb. 2013).

[50]

Yee, B., Sehr, D., Dardyk, G., Chen, J. B., Muth, R., Ormandy, T., Okasaka, S., Narula, N., and Fullagar, N. Native client: A sandbox for portable, untrusted x86 native code. In Proc. of IEEE Security and Privacy (Oakland, CA, May 2009).

Digital Library

[51]

Zhang, F., Chen, J., Chen, H., and Zang, B. CloudVisor: Retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization. In Proc. of ACM SOSP (Cascais, Portugal, Oct. 2011).

Digital Library

Cited By

Cho KBahn H(2024)A Lightweight File System Design for UnikernelApplied Sciences10.3390/app1408334214:8(3342)Online publication date: 16-Apr-2024
https://doi.org/10.3390/app14083342
Misono MOkelmann PMainas CBhatotia P(2024)uIO: Lightweight and Extensible UnikernelsProceedings of the 2024 ACM Symposium on Cloud Computing10.1145/3698038.3698518(580-599)Online publication date: 20-Nov-2024
https://dl.acm.org/doi/10.1145/3698038.3698518
Wada TYamada H(2024)Reboot-Based Recovery of Unikernels at the Component Level2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)10.1109/DSN58291.2024.00017(15-28)Online publication date: 24-Jun-2024
https://doi.org/10.1109/DSN58291.2024.00017
Show More Cited By

Index Terms

Unikernels as Processes

Recommendations

My VM is Lighter (and Safer) than your Container
SOSP '17: Proceedings of the 26th Symposium on Operating Systems Principles

Containers are in great demand because they are lightweight when compared to virtual machines. On the downside, containers offer weaker isolation than VMs, to the point where people run containers in virtual machines to achieve proper isolation. In this ...
Want more unikernels?: inflate them!
SoCC '22: Proceedings of the 13th Symposium on Cloud Computing

Unikernels are on the rise in the cloud. These lightweight virtual machines (VMs) specialized to a single application offer the same level of isolation as full-blown VMs, while providing performance superior to standard Linux-based VMs or even to ...
A critical survey of live virtual machine migration techniques

Virtualization techniques effectively handle the growing demand for computing, storage, and communication resources in large-scale Cloud Data Centers (CDC). It helps to achieve different resource management objectives like load balancing, online system ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

SoCC '18: Proceedings of the ACM Symposium on Cloud Computing

October 2018

546 pages

ISBN:9781450360111

DOI:10.1145/3267809

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 11 October 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Conference

SoCC '18

Sponsor:

SoCC '18: ACM Symposium on Cloud Computing

October 11 - 13, 2018

CA, Carlsbad, USA

Acceptance Rates

Overall Acceptance Rate 169 of 722 submissions, 23%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

36
Total Citations
View Citations
3,133
Total Downloads

Downloads (Last 12 months)121
Downloads (Last 6 weeks)8

Reflects downloads up to 20 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Cho KBahn H(2024)A Lightweight File System Design for UnikernelApplied Sciences10.3390/app1408334214:8(3342)Online publication date: 16-Apr-2024
https://doi.org/10.3390/app14083342
Misono MOkelmann PMainas CBhatotia P(2024)uIO: Lightweight and Extensible UnikernelsProceedings of the 2024 ACM Symposium on Cloud Computing10.1145/3698038.3698518(580-599)Online publication date: 20-Nov-2024
https://dl.acm.org/doi/10.1145/3698038.3698518
Wada TYamada H(2024)Reboot-Based Recovery of Unikernels at the Component Level2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)10.1109/DSN58291.2024.00017(15-28)Online publication date: 24-Jun-2024
https://doi.org/10.1109/DSN58291.2024.00017
Kappes GAnastasiadis S(2023)Diciclo: Flexible User-level Services for Efficient Multitenant IsolationACM Transactions on Computer Systems10.1145/363940442:1-2(1-47)Online publication date: 30-Dec-2023
https://dl.acm.org/doi/10.1145/3639404
Huang HLai JRao JLu HHou WSu HXu QZhong JZeng JWang XHe ZHan WLiu JMa TWu SDruschel PKaufmann AMace JFlinn JSeltzer M(2023)PVM: Efficient Shadow Paging for Deploying Secure Containers in Cloud-native EnvironmentProceedings of the 29th Symposium on Operating Systems Principles10.1145/3600006.3613158(515-530)Online publication date: 23-Oct-2023
https://dl.acm.org/doi/10.1145/3600006.3613158
Le MAhmed SWilliams DJamjoom H(2023)Securing Container-based Clouds with Syscall-aware SchedulingProceedings of the 2023 ACM Asia Conference on Computer and Communications Security10.1145/3579856.3582835(812-826)Online publication date: 10-Jul-2023
https://dl.acm.org/doi/10.1145/3579856.3582835
Raza AUnger TBoyd MMunson ESohal PDrepper UJones RDe Oliveira DWoodman LMancuso RAppavoo JKrieger OFedorova ANarayanan DDi Luna GQuerzoni L(2023)Unikernel Linux (UKL)Proceedings of the Eighteenth European Conference on Computer Systems10.1145/3552326.3587458(590-605)Online publication date: 8-May-2023
https://dl.acm.org/doi/10.1145/3552326.3587458
Lupu CAlbișoru ANichita RBlânzeanu DPogonaru MDeaconescu RRaiciu CFedorova ANarayanan DDi Luna GQuerzoni L(2023)Nephele: Extending Virtualization Environments for Cloning Unikernel-based VMsProceedings of the Eighteenth European Conference on Computer Systems10.1145/3552326.3587454(574-589)Online publication date: 8-May-2023
https://dl.acm.org/doi/10.1145/3552326.3587454
von Arnim CWalker MLechler ARiedel OVerl A(2023)Isolating Shared Resources for Time-Triggered Networking of Containerized Applications2023 29th International Conference on Mechatronics and Machine Vision in Practice (M2VIP)10.1109/M2VIP58386.2023.10413388(1-6)Online publication date: 21-Nov-2023
https://doi.org/10.1109/M2VIP58386.2023.10413388
Wruck FSarafov VJakobsmeier FWeiß MGupta MKhorsandroo SAbdelsalam M(2022)GyroidOSProceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems10.1145/3510547.3517917(87-96)Online publication date: 18-Apr-2022
https://dl.acm.org/doi/10.1145/3510547.3517917
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents