Over the last several years, I and others have talked about the promise of unikernels — single-purpose, lightweight virtual machines — in the cloud. However, all of these talks have simply presented our architectures and speculated about their usefulness. Over the last several years, Galois has actually been using unikernels to implement interesting components in critical systems: non-bypassable encryption components, network monitors and alarms, platform obfuscation capabilities, Tor nodes, network re-routers, and so on. In this talk, I will speak briefly on each of them and ask the question: Was a unikernel a good platform for this project? If so, why? If not, why not? What are the general rules we can infer about when unikernels are useful, and what part of the cloud ecosystem they are best suited to serve?

1. © 2014 Galois, Inc. All rights reserved.
Unikernels:
Who, What, Where, When, Why?
Adam Wick (awick@galois.com)
Xen Developer Summit | August 19th, 2014

2. © 2014 Galois, Inc. All rights reserved.
?
mini
OS
HALVM
Which? When? Why?

3. © 2014 Galois, Inc. All rights reserved.
?
mini
OS
HALVM
Unikernel: (a.k.a. Library OSes)
A single-purpose, single-language
virtual machine hosted on a minimal
environment.

4. © 2014 Galois, Inc. All rights reserved.
Unikernels:
Who, What, Where, When, Why?
• The advantages and disadvantages of
unikernels.
• Where Galois has used them in the past
that worked.
• … and didn’t work.
• What general rules we think apply.

5. Application Application Application
opengl
iconv gtk
libz libgmp libtls
libC libstdc++ libgcc
© 2014 Galois, Inc. All rights reserved.
?
Operating System

6. © 2014 Galois, Inc. All rights reserved.
Why?

7. © 2014 Galois, Inc. All rights reserved.
Why?
 Reduced memory footprint.
 Greatly reduced need for disk
space.
 Reduced computational burden.
Use less powerful VM classes for
the same work, and save money.

8. © 2014 Galois, Inc. All rights reserved.
Why?
 Reduced memory footprint.
 No extraneous processes taking
up your CPU.
 Fewer schedulers interrupting
things.
Faster load times, lower latencies.

9. © 2014 Galois, Inc. All rights reserved.
Why?
 Reduced code size.
 Customized to application.
 (Potentially) Stronger walls
between disparate components.
Less exposure to general attacks,
reduced privileges, reduced attack
surface.

10. Why not?
Application Application Application
opengl
iconv gtk
libz libgmp libtls
libC libstdc++ libgcc
© 2014 Galois, Inc. All rights reserved.
?
Operating System
If this is what you want, don’t fix what isn’t broken.

11. Why not?
opengl
iconv gtk
libz libgmp libtls
libC libstdc++ libgcc
© 2014 Galois, Inc. All rights reserved.
?
Operating System
There is a lot of software for Linux; with a unikernel,
you will end up writing these bits and pieces.

12. © 2014 Galois, Inc. All rights reserved.
Why not?
* These savings come from
avoiding some expenses:
removing the need for disks,
lowering processor costs.
If your application needs them
anyways, you’re not going to see
any savings.
*

13. © 2014 Galois, Inc. All rights reserved.
Unikernels:
Who, What, Where, When, Why?
• The advantages and disadvantages of
unikernels.
• Where Galois has used them in the past
that worked.
• … and didn’t work.
• What general rules we think apply.

14. Mission:
To create trustworthiness in critical systems.
Research services and prototype development in computer science.
Operating Systems
Networking Cryptography
Scientific Computing
Human/Computer Interaction
Programming Lanuages
Formal Methods
We built the HaLVM as part of one of our projects, and
have successfully used it on many more since then. What
have we learned?
© 2014 Galois, Inc. All rights reserved.
Security
Safety
Privacy
Reliability
Predictability
Integrity
W

15. © 2014 Galois, Inc. All rights reserved.
Three Main Use Cases
Use Case #1
Embedded,
Single-Host,
Deprivileged
Security Apparatus
Use Case #3
Highly flexible,
Highly mobile,
On-demand
Network Nodes
Use Case #2
Lightweight,
Scalable,
Local Network
Capabilities

16. © 2014 Galois, Inc. All rights reserved.
Use Case #1
Dom0 DomU

17. © 2014 Galois, Inc. All rights reserved.
Use Case #1
Dom0 DomU
Unavoidable …
… encryption.
… filtering.
… tunneling.

18. © 2014 Galois, Inc. All rights reserved.
Use Case #1
Unikernels allow for
fine-grained separation
of concerns:
• Key management
• RNG
• Encrypt / Decrypt
• Networking

19. © 2014 Galois, Inc. All rights reserved.
Use Case #1
Lesson: Unikernels are small and fast, so they
make a great platform for building critical security
components.
Combine with XSM to use Xen as a lightweight
separation kernel.
BUT

20. © 2014 Galois, Inc. All rights reserved.
Use Case #1
We have been mostly successful using unikernels in this
general area.
dangerous word
The one place it didn’t work: a device driver.
opengl
iconv gtk
libz libgmp libtls
?
libC
libstd
c++
libgcc
Operating System
Unikernels can make major, mid-stream changes more
costly, because their specialization works against them.

21. © 2014 Galois, Inc. All rights reserved.
Awkward Transition Slide

22. Use Case #2 (Your Network)
© 2014 Galois, Inc. All rights reserved.
Firewalls are nice, but they are going to be broken.
(Or dodged.)
How quickly can you detect that someone has broken
into yournetwork, and how fast can you respond?
Confuse, distract, delay, discover: Make them work
harder, and make them easier to detect.
Unikernels make great hosts for these nodes, because
they are lightweight and responsive.

23. © 2014 Galois, Inc. All rights reserved.
Use Case #3 (The Cloud!)
Unikernels have two major advantages
over more traditional systems in the cloud:
1. They’re nimble.
2. They scale massively.
… as long as your service fits within a certain mold.
Do you need a local disk?

24. © 2014 Galois, Inc. All rights reserved.
Use Case #3: Nimble

25. © 2014 Galois, Inc. All rights reserved.
Use Case #3: Nimble

26. Use Case #3: Nimble + Massive
© 2014 Galois, Inc. All rights reserved.

27. © 2014 Galois, Inc. All rights reserved.
Unikernels:
Who, What, Where, When, Why?
• The advantages and disadvantages of
unikernels.
• Where Galois has used them in the past
that worked.
• … and didn’t work.
• What general rules we think apply.

28. © 2014 Galois, Inc. All rights reserved.
Unikernels
What? A lightweight mechanism for implementing
single-service components.
Who? Designers of cloud, local network, or low-level
security services.
Where? Useful for securing or rapidly deploying
lightweight or security-sensitive services.
When? For situations, like those described, for
which the increased cost of development for
a unikernel is outweighed by a unikernel’s
advantages.
Why? To save money.
To improve efficiency.
To improve security.

29. © 2014 Galois, Inc. All rights reserved.
Summary
Unikernels: Useful for us.
≥?
Where will you use them?
HaLVM: http://halvm.org
Mirage: http://openmirage.org

30. All trademarks, service marks, trade names, trade dress, product
names and logos appearing in these slides are the property of their
respective owners, including in some instances Galois, Inc.
© 2014 Galois, Inc. All rights reserved.
All rights are reserved.