if you enforce user input to specific shapes... and only have certain system calls... I think a unikernel version of a hackernews style site really wouldn't have RCE... especially if you build in KSLR / memory tagging in the unikernel security model...