MirageOS 4.0 – Self-managed internet infrastructure with unikernels

https://mirage.io/blog/announcing-mirage-40

by kirschner • 4 years ago

163 37 4 years ago

onebot• 4 years ago

I am fascinated by Unikernels. But how do they deal with things that need to fork or run multiple processes? Aren't they restricted to single processes?

sanxiyn• 4 years ago

Yes they are, but you don't need to fork for a lot of workloads.

actionfromafar• 4 years ago

The new version of OCaml got multiprocessor support recently.

https://www.infoq.com/news/2021/10/ocaml-5-multicore/

hannesm5• 4 years ago

We use asynchronous tasks in MirageOS (cooperative multitasking) using lwt http://ocsigen.org/lwt/latest/manual/manual, so you can serve multiple network connections at the same time.

Since there are no processes, there's no concept of "fork", but indeed you can run multiple tasks at the same time (using the same address space). Why again would you need multiple processes? Since the programming language OCaml has a semantics and is memory-safe, there's no strong reason for isolation at execution time (apart from the C bits, which we try to keep to a minimum and compile with runtime safety flags (red-zone for stack protection, mapping execute-only (seems to only reliably work on OpenBSD), etc.)).

asymmetric• 4 years ago

Is this also how you deal with logging/monitoring?

Do you have a concept of logging daemon? How would I run prometheus exporter-like things?

Is there a FAQ where questions along these lines are answered?

scns• 4 years ago

Conurrency instead of parallelism.

gpderetta2• 4 years ago

What about multiprocessing? I assume that MirageOS can take advantage of multiple cores (or do you need separate instances per core?). In this case is the system still shared memory?

Also I would say there are reasons for isolation beyond memory safety.

avsm2• 4 years ago

This all started because we wanted to _get away_ from the need to fork or run multiple processes, since that's so hard in a variety of hardware architectures (like mobile or embedded).

Other researchers also share the dislike of fork... https://www.microsoft.com/en-us/research/uploads/prod/2019/0...

A 2010 paper where I sketched out some of the early ideas around "multiscale" is here: https://anil.recoil.org/papers/2010-bcs-visions.pdf

It took a little longer than I'd planned, but thanks to the hard work of so many MirageOS contributors, now's a pretty good time to glue back personal containers and self-hosted data management infrastructure again! Unikernel-based messaging has really come together in the past couple of years: https://tarides.com/blog/2022-03-08-secure-virtual-messages-...

rwmj• 4 years ago

Unikernel Linux (UKL - https://github.com/unikernellinux) actually does allow you to fork. The main unikernel program runs in kernel space linked to Linux, and after a fork you get a new, regular userspace process.

mindwok3• 4 years ago

This project mentions it’s based on the Xen hypervisor and uses EC2 as an example for running it, but haven’t AWS now moved to their own KVM based hypervisor? Would this still work?

detaro• 4 years ago

You can still choose Xen-based instances in EC2.

mindwok3• 4 years ago

Ahh ok. I imagine you would lose all the nice Nitro stuff though like enhanced networking etc which is a bummer.

wmf2• 4 years ago

This isn't good advice. People should probably use the hvt backend on AWS.

hannesm5• 4 years ago

In ancient times, only Xen was supported. Nowadays, the support moved to:

  - Xen (PVH)
  - Linux KVM, FreeBSD BHyve, OpenBSD VMM
  - SPT (seccomp, no hardware virtualization)
  - virtio (GCE, ..)
  - muen (muen.sk)

Take a look at https://github.com/solo5/solo5 which is used as the low level bits to run OCaml.

mwcampbell• 4 years ago

- SPT (seccomp, no hardware virtualization)

To be clear, this means running an ordinary Linux binary, right?

I'm curious about the remaining advantages in practice of running multiple processes on a shared kernel rather than using hardware virtualization. I guess the main one is more efficient resource pooling, particularly memory and the page cache. I understand the primary advantage of virtualization is a smaller attack surface.

laurensr• 4 years ago

This name is associated with a lot of nostalgia for me, as it is the same name as the shell launcher for Texas Instruments' TI-83/84 graphing calculators.

jychang• 4 years ago

I was wondering why the name sounded familiar. For a second I thought this was referring to ReactOS, which is something else completely different.

Flameancer• 4 years ago

I was about to mention the same thing. Theses appear to be completely unrelated projects. And here I was about to dust of the old TI-84 to try it out.

osener• 4 years ago

There's a fantastic episode of Signals & Threads podcast about MirageOS's roots, Xen Hypervisor and more with Anil Madhavapeddy as the guest. I found it very thought provoking: https://signalsandthreads.com/what-is-an-operating-system/

lokedhs• 4 years ago

MirageOS is really interested when combined with Qubes OS. I've started looking at MirageOS, and since I use Qubes, being able to run things directly on Xen right next to my regular VM's is really neat.

There are also projects to replace sys-firewall with a MirageOS unikernel instead. That's something that seems very interesting.

imachine1980_• 4 years ago

Qubes OS?

kirschner• 4 years ago

Have a look at https://www.qubes-os.org/ It is a Free Software operating system with the focus on security.

pbronez• 4 years ago

Does MirageOS exclusively support native Ocaml applications? Or does it appear to applications like a standard OS, so you can develop with anything?

For example, they show how you can host a static site. Great, but can I run my Flask API?

pjmlp2• 4 years ago

MirageOS is indeed only for OCaml.

If you want a POSIX unikernel have a look at Unikraft.

MirageOS 4.0 – Self-managed internet infrastructure with unikernels

Related Stories