Unikernels: The new kids on the block

UnikernelsUnikernelsThe new kids on the block

Jakub Jermář[email protected]

@jjermar

Unikernels: The new kids on the block, Jakub Jermář, Avast TechTalk, March 4, 2016 2

Original software stackOriginal software stack

Application

Hardware


Application

Kernel

Hardware

Adding non-privileged modeAdding non-privileged mode


Memory management

Scheduler

Device drivers

TCP/IP stack

File systems

Bootstrap code

Modern desktopModern desktop

Hardware

Kernel

System libraries

Application libraries

Application

Runtime environment

System libraries


Application

System libraries


Application

System libraries


Application

System libraries


Application

Runtime environment

System libraries


Application

Runtime environment


Memory management

Scheduler

Device drivers

Bootstrap code

Hardware

Hypervisor

VM

Modern data centerModern data center


Vertical slice of the stackVertical slice of the stack

Memory management

Scheduler

Device drivers

Bootstrap code

Hardware

Memory management

Scheduler

Device drivers

TCP / IP stack

File systems

Bootstrap code

System libraries


Applications

Runtime environment


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware

Allocator | Address spaces

Threads | Processes

ATA | SATA | E1000 | RTL8169 | USB

IPv4 | IPv6 | UDP | TCP | ARP | ICMP

Ext4 | FAT | TMPS | ISO9660

Bootstrap code

System libraries

lib1 | lib2 | lib3 | lib4

bash | ssh | Nginx | MySQL

Runtime environment


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS

Is this an overkill?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS


For a VM in a data center?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS



What parts are essential?



Memory management

Scheduler

Device drivers

Bootstrap code

Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS





Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS




How many SPOFs?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS




How many SPOFs?

When not to do this?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware


Threads | Processes




Bootstrap code

System libraries



Runtime environment

General purpose OS




How many SPOFs?


What's left?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware

Allocator

Threads

SATA | RTL8169

IPv6 | TCP

Ext4

Bootstrap code

System libraries

lib1 | lib3

Nginx

General purpose OS




How many SPOFs?


What's left?


Memory management

Scheduler

Device drivers

Bootstrap code


Hardware

Allocator

Threads

SATA | RTL8169

IPv6 | TCP

Ext4

Bootstrap code

System libraries

lib1 | lib3

Nginx

Unikernel


Memory management

Scheduler

Device drivers

Bootstrap code

Hardware

Allocator

Threads

SATA | RTL8169

IPv6 | TCP

Ext4

Bootstrap code

System libraries

lib1 | lib3

Nginx

Unikernel

Hardware

Allocator

E1000

IPv4 | UDP

Bootstrap code

System libraries

lib1 | lib2

dhcp



Back to the rootsBack to the roots

Unikernel

Hardware


Back to the rootsBack to the roots

Hypervisor

Unikernel

Hardware


Unikernels...Unikernels...



single purpose OS images



include only what they need



are quite small



are quite small

[rumprunpackages/nginx]$ file nginx.binnginx.bin: ELF 64bit LSB executable, x8664, version 1 (SYSV), statically linked, not stripped[rumprunpackages/nginx]$ ls sh nginx.bin; strip nginx.bin; ls sh nginx.bin33M nginx.bin5.4M nginx.bin



have very short boot times




[HaLVM/examples/Core/Null]$ time (sudo xl create Null.config; sudo xl dmesg c)Parsing config from Null.config(d80) Starting 1CPU HaLVM(d80) init_sp: 0x00000000004ba000(d80) self: 0x00000000004b9f6e(XEN) grant_table.c:1249:d80 Expanding dom (80) grant table from (4) to (32) frames.(d80) Exit called with 0

real 0m0.154suser 0m0.026ssys 0m0.087s




DNS query start!

donereply

request

[HaLVM/examples/Core/Null]$ time (sudo xl create Null.config; sudo xl dmesg c)Parsing config from Null.config(d80) Starting 1CPU HaLVM(d80) init_sp: 0x00000000004ba000(d80) self: 0x00000000004b9f6e(XEN) grant_table.c:1249:d80 Expanding dom (80) grant table from (4) to (32) frames.(d80) Exit called with 0

real 0m0.154suser 0m0.026ssys 0m0.087s

https://github.com/mirage/jitsu

Client

DNSserver

Microservice



run in a single address space



no privilege levels to cross



usually target hypervisors




Xen PV

Unikernel domUXen PV driver frontend

dom0Xen PV driver backend




VirtIO PV driver backend

QEMU/KVM/VirtualBox

UnikernelVirtIO PV driver frontend

Xen PV

Unikernel domUXen PV driver frontend

dom0Xen PV driver backend



some run on bare metal too



and even on top of Unix



implemented in C



implemented in C

void quicksort(int array[], int left_begin, int right_begin){ int pivot = array[(left_begin + right_begin) / 2]; int left_index, right_index, pom; left_index = left_begin; right_index = right_begin; do { while (array[left_index] < pivot && left_index < right_begin) left_index++; while (array[right_index] > pivot && right_index > left_begin) right_index--;

if (left_index <= right_index) { pom = array[left_index]; array[left_index++] = array[right_index]; array[right_index--] = pom; } } while (left_index < right_index); if (right_index > left_begin) quicksort(array, left_begin, right_index); if (left_index < right_begin) quicksort(array, left_index, right_begin);}



but also in high-level languages




quickSort :: Ord a => [a] -> [a]quickSort [] = []quickSort (x:xs) = quickSort [a | a <- xs, a < x] ++ [x] ++ quickSort [a | a <- xs, a >= x]




quickSort :: Ord a => [a] -> [a]quickSort [] = []quickSort (x:xs) = quickSort [a | a <- xs, a < x] ++ [x] ++ quickSort [a | a <- xs, a >= x]

let rec qsort = function | [] -> [] | pivot :: rest -> let is_less x = x < pivot in let left, right = List.partition is_less rest in qsort left @ [pivot] @ qsort right


The ZOOThe ZOO


Rumprun + rump kernelsRumprun + rump kernels

http://rumpkernel.org

existing POSIX applications

anykernel (NetBSD) → file systems, POSIX layer, device drivers, TCP/IP, storage stack → a rump kernel

Xen PV/QEMU/KVM

rumprun

Rump kernel

Application

Hardware

rumprun

Rump kernel

Application


MirageOSMirageOS

http://mirage.io

From-scratch implementation in OCaml

mirage-tcpip, mirage-net-xen, ocaml-cohttp, mirage-block-xen, ocaml-fat

Xen PV

Mini-OS/rumprun

Libs & OCaml runtime

Application

QEMU/KVM

Solo5/rumprun


Application

Unix


Application


HaLVMHaLVM

http://halvm.org

From-scratch implementation in Haskell

HaNS, Halfs, http-server

Xen PV

HaLVM

Application


ClickOS (C/C++)

Clive (Go)

Drawbridge (C)

IncludeOS (C++)

LING (Erlang)

OSv (C, JVM, Ruby, Node.js)

runtime.js (JavaScript)

And othersAnd others


DemoDemo

Keep your fingers crossed!


Not a moment, but a movementNot a moment, but a movement


Discussion: which architecture?Discussion: which architecture?



Container / Zone

Hardware

KernelTCP / IP | file system | drivers

Container / Zone

MicroserviceLibs

MicroserviceLibs

MicroserviceLibs



Hardware

Microkernel

MicroserviceLibs

MicroserviceLibs

TCP/IPLibs

File systemLibs

DriversLibs



Your mileage may vary


Unikernels and DockerUnikernels and Docker


Unikernels, meet Docker!

Unikernel Systems is now part of Docker



Q&Awww.unikernel.org

Thank you!Thank you!

Unikernels: The new kids on the block

Technology

Transcript of Unikernels: The new kids on the block