I'm not sure I exactly get what "separation kernel" means. The linked wikipedia page doesn't help much. But the description of the problem leads me to unikernels as the answer.