Working with Unikernel Volumes in Nanos | Hacker News Reader

Working with Unikernel Volumes in Nanos

nanovms.com

42 pointseyberg10 comments

Does anyone use this product? Unikernels seem like they should really be the Next Big Thing - the container ecosystem has gotten too crazy, too many layers, too much cruft between what you want to run and where it's running. This seems like a really amazing alternative that brings things back to where server hardware had been evolving to go, in terms of features for virtualization and isolation.

Can I run Ruby in a unikernel yet?

* We do have paying customers yes.

* Yes you can run ruby. Looks like we have packages for 2.3, 2.5 and 2.7 currently - it'd be trivial to add more runtimes.

That's awesome. I will definitely dig into this. I hope that Ruby stuff built against C also works with this (many things have native binaries that are built at gem install time for performance).

While I have you -

Any thoughts on support for ESXi? I have a bunch of VMware and would love to run these on top. I gather that it will run, but without hardware acceleration? What does that actually mean?

Edit: Ah, https://nanovms.gitbook.io/ops/vsphere answers some of this.

The native libraries just need to be included onto the fs. Every interpreted language out there is like this. Also, the gem install step can be done outside of the unikernel and then have the artifacts loaded on.

We have current ESXi VSphere support today - both for 6.7 and 7.0. There are some docs here: https://nanovms.gitbook.io/ops/vsphere .

When you deploy a unikernel it's packaged as a virtual machine so it's not like you are deploying a linux vm and then running this on top - you are deploying your application as it's own isolated vm and it is hardware accelerated. Without hardware acceleration the "cloud" wouldn't exist, however instead of running 2 layers of linux (hypervisor and guest) we recognize that we're virtualized and that we don't need an extra full blown linux running as guest.

Fantastic, I will try something out against the Vsphere. So I guess I'm creating a VM template with this, similar to what I'd do with Packer, and then theoretically I should still be able to use Terraform to spin one up.

What about passing run-time configuration? Is that all supposed to just be built-in, or is a well-designed program expected to reach out and get it somehow (e.g. from Consul)? Am I supposed to bake in keys to give it access to things?

You can use terraform to spin it up but a lot of that becomes un-necessary as that is assuming you are deploying a linux vm or something similar. Packer itself would be totally replaced with something like OPS - https://ops.city as ops produces machine images for the various hypervisors - but to be clear - you don't have to use ops but nothing else gives you a cloud deploy in 2 min and 2 commands.

OPS allows you to pass quite a lot of configuration related switches/options/etc: https://nanovms.gitbook.io/ops/configuration and config files that you need on disk can be copied in at build time too. Env vars and such can be injected as well.

If you want to keep using a secret store like Vault that's totally fine and up to you and your application needs. As mentioned in the article some companies use volumes to rotate certs every few hours/day via volumes so the sensitive stuff is separated from deploys.

The problem with Unikernels is legacy software. In order to effectively run Unikernels you have to program for them.

I think the big jump in unikernels will come when someone can build Linux as a safe Unikernel and create a tool that converts docker images into Unikernel images. It's doable, but incredibly hard.

Disclaimer:

I'm sure there are lots of instances for folks where programming for Unikernels makes sense, but obviously legacy software will be around for a while.

There have been some efforts to take regular Linux binaries and build unikernels from them:

- Lupine Linux uses specialization: https://www.youtube.com/watch?v=AoskLn1Xovc

- HermitCore reimplements a small subset of Linux that covers the majority of apps, so that they can run with it as a unikernel: https://www.youtube.com/watch?v=wHLqSb4Op4s

nanos in particular runs unmodified linux _binaries_ and produces bootable virtual machines

"Unikernels are fast, secure, increase server density and eliminate devops."

bold statement, by whatever definition of devops you use

Reply on news.ycombinator.com