Hacker News Reader

> I'd love to see Anil [...] comment.

Does a tweet count as commentary for you?

" Profiling MirageOS unikernels from a Xen dom0, an excellent and short howto -- http://www.brendangregg.com/blog/2016-01-27/unikernel-profil... " https://twitter.com/avsm/status/692396667576938497

Also, it's the Cambridge Computer Lab you're thinking of (at the University of Cambridge).

We also spoke about debugging (but not to this depth) on today's Docker Online Meetup about unikernels. We made the same points but Brendan's post is fantastic as he shows a worked example. There's a discussion thread [1] and there'll be a video of that webinar out soon too.

[1] https://devel.unikernel.org/t/docker-online-meetup-about-uni...

amirmcon Docker Acquires Unikernel Systems as It Looks Beyond Containers

Antti isn't part of Unikernel Systems. List of people involved can be found at http://unikernel.com/#notice

amirmcon Docker Acquires Unikernel Systems as It Looks Beyond Containers

Unikernel Systems was supporting the community site (i.e. paying for stuff) and that will continue with Docker. It's important that the open-source work continues to grow and that all the projects benefit from each other. unikernel.org just got started so we need help to grow it and make it the place to go.

Also, the word 'unikernel' is used like a generic term and as far as I know it's not trademarked.

amirmcon Docker Acquires Unikernel Systems as It Looks Beyond Containers

There are many other benefits to unikernels especially depending on which implementation you choose to go with. For example, MirageOS and Rumprun are good examples of clean-slate vs current systems. I'd recommend reading some of the articles at http://unikernel.org/resources to get better view of this.

As for 'a user friendly mechanism like Docker' ... well, I hope today's news convinces you that it's in progress.

amirmcon Docker Acquires Unikernel Systems as It Looks Beyond Containers

We also put a note on the company website [1]. I'm looking forward to working with the Docker folks on this. :)

[1] http://unikernel.com/#notice (not to be confused with the community website at http://unikernel.org :)

amirmcon Docker Acquires Unikernel Systems as It Looks Beyond Containers

There are more resources at http://unikernel.org/resources

amirmcon Ask HN: Which people and groups are researching new approaches to programming?

Probabilistic programming might interest you.

e.g. http://arxiv.org/abs/1507.00996

amirmcon The Solo5 Unikernel

> "One great thing about unikernels is that fragmentation is not really a problem: it's a good thing to have a healthy, diverse ecosystem of unikernel libraries adapted for different purposes."

I agree with having a diverse set of libraries but we need to take care that we solve common problems in a consistent way. For example, passing config parameters into unikernels, how they get deployed to common cloud platforms and even how we monitor and log activity. For unikernels to become mainstream, we need to ensure we don't fragment this part of the toolchain (silos won't help adoption). It's part of why https://devel.unikernel.org exists -- to share solutions and converge on tooling.

amirmcon The Solo5 Unikernel

There's an introductory blog post at https://mirage.io/blog/introducing-solo5

(And a new discussion site for unikernel development at https://devel.unikernel.org)

amirmcon Tech Startups Face Fresh Pressure on Valuations

From your description, it seems reasonable to call this 'a correction' in the market. Those who've raised enough (& manage their burn) might be able to justify their valuations to the public markets in due course.

(love the sea turtle analogy)

amirmcon Microkernels are slow and Elvis didn't do no drugs

Yes, of course. I should also have linked to the Unikernel+Docker demo [1], which is taking legacy software and using Rump Kernels and the Docker toolchain to deploy unikernels (to show how all these things can create a multiplier effect in terms of benefits).

It would be great to get a list of live unikernel deployments listed somewhere to address questions like this when they come up.

[1] http://unikernel.org/blog/2015/unikernels-meet-docker/

amirmcon A Unikernel Firewall for QubesOS

That doesn't do it justice and there's more to it than that e.g. the readability (and 'debugablity') of the new code.

I note that the post does have a very useful summary at the end, which is a 90 sec read (there's even a ToC at the beginning that can take you straight there). I've copied it below in case that's useful.

"QubesOS provides a desktop environment made from multiple virtual machines, isolated using Xen. It runs the network drivers (which it doesn’t trust) in a Linux “NetVM”, which it assumes may be compromised, and places a “FirewallVM” between that and the VMs running user applications. This design is intended to protect users from malicious or buggy network drivers.

However, the Linux kernel code running in FirewallVM is written with the assumption that NetVM is trustworthy. It is fairly likely that a compromised NetVM could successfully attack FirewallVM. Since both FirewallVM and the client VMs all run Linux, it is likely that the same exploit would then allow the client VMs to be compromised too.

I used MirageOS to write a replacement FirewallVM in OCaml. The new virtual machine contains almost no C code (little more than malloc, printk, the OCaml GC and libm), and should therefore avoid problems such as the unchecked array bounds problem that recently affected the Qubes firewall. It also uses less than a tenth of the minimum memory of the Linux FirewallVM, boots several times faster, and when it starts handling network traffic it is already fully configured, avoiding e.g. any race setting up firewalls or DNS forwarding.

The code is around 1000 lines of OCaml, and makes it easy to follow the progress of a network frame from the point where the network driver reads it from a Xen shared memory ring, through the Ethernet handling, to the IP firewall code, to the user firewall policy, and then finally to the shared memory ring of the output interface.

The code has only been lightly tested (I’ve just started using it as the FirewallVM on my main laptop), but will hopefully prove easy to extend (and, if necessary, debug)."

amirmcon Microkernels are slow and Elvis didn't do no drugs

It's beyond experiments now and there are clear uses for such things. For example, a recent post describes using MirageOS to build a firewall VM [1]. There are also network security/intrusion-detection systems [2].

There are a number of ways to build unikernels and they're not all OCaml (which is just MirageOS) -- http://unikernel.org is trying to bring these together.

[1] http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewal...

[2] https://galois.com/project/cyberchaff/

amirmcon Ask HN: New Year's resolution – What projects are you planning to start in 2016?

Congrats! This is quite interesting and I look forward to seeing the site. Have you come across CyberChaff [1]? It seems like you may have similar goals. CyberChaff makes use of HaLVM [2] so this approach (using unikernels) seems like it might suit you too.

I've put together a website to help gather the unikernel projects [3], so if you choose to consider this approach for your next round of work, please do share your experiences there!

[1] https://galois.com/project/cyberchaff/ [2] https://github.com/GaloisInc/HaLVM [3] http://unikernel.org

amirmcon Unikernels, meet Docker

Just to close the loop, we did release the code.

See the post at: http://unikernel.org/blog/2015/contain-your-unikernels/

amirmcon Rump Kernel FAQ

Yeah, I noticed that too for one on my submissions. I guess HN changed how it deals with resubmission.

amirmcon First Timers Only

We've a curated set of Pioneer Projects for MirageOS [1], where more established contributors have agreed to act as mentors for newcomers. It's worked really well for us!

One of the unexpected benefits was that we could quickly take part in things like Outreachy and GSoC, as we already had a curated list. Reviewing this list every few months has become part of the normal process now.

In addition, asking people to act as mentors also gives them a different perspective on the existing code base, especially where things are particularly thorny.

[1] https://github.com/mirage/mirage-www/wiki/Pioneer-Projects

amirmcon What is a 'unikernel'?

I've described it by saying unikernels are constructed by library operating systems. ie, the unikernel is the artefact but the libOS is what you (as a dev) actually work with.

The first line of the Wikipedia page is written this way - https://en.wikipedia.org/wiki/Unikernel

amirmcon What is a 'unikernel'?

> "You lose some of the convenience of management of containers in order to get this."

Not necessarily... http://unikernel.org/blog/2015/unikernels-meet-docker/

amirmcon What is a 'unikernel'?

Depends on where you imagine the work to be.

I tend to think of unikernels as having to 'front-load' more of the work. That's why you can treat the end artefact as almost disposable.

With a traditional stack, it may be easier to set up, but you're then committing to acting as caretaker for the code that runs on that machine, inc. patches, upgrades, version constraints, etc. There's probably more work there over the long term.

This is kind of where the distinction of 'cattle vs pets' comes from.

amirmcon What is a 'unikernel'?

There was a recent post about about Unikernels and Docker [1] (that post is also linked in the OP).

[1] https://news.ycombinator.com/item?id=10585404

amirmcon Unikernels, meet Docker

Not yet (sorry) but will do soon!

amirmcon Unikernels, meet Docker

I do see what you mean but asking people to re-write all the things isn't a successful strategy to achieve mass adoption.

Being able to build your unikernel (micro)services using legacy things and then swapping out certain services for clean-slate versions seems like a much more palatable approach. This is why unikernels fit so well with the microservices approach — you only have to re-write things one piece at a time if you choose to.

amirmcon Unikernels, meet Docker

I think because they play very nicely with legacy software, without needing any modifications. i.e the demo has unmodified, off-the-shelf versions of nginx, mysql and php.

The other unikernel projects (i.e. MirageOS and HaLVM), take a clean-slate approach which means application code also has to be in the same language (OCaml and Haskell, respectively). However, there's also ongoing work to make pieces of the different implementations play nicely together too (but it's early days).

amirmcon Unikernels, meet Docker

We'll be releasing the code sometime tomorrow afternoon. We need a bit of extra time to clear out the unused code, make a readme, and also get some rest. :)

I'll add a link to the blog post when it's live.

amirmcon Making Popcorn: Adding a Disk to a Rust Rumprun Unikernel

For those interested in unikernels. We just launched a community website — http://unikernel.org

amirmcon Irmin: Git-like distributed DB

[ To avoid any confusion, the submitter is not the author of the post :) ]

I don't really understand the question about the stack. Where it belongs should only limited by its features.

It certainly can be used by people developing browser-based apps. For example, Cuekeeper [1] is a version-controlled TODO manager which uses Irmin. It's also been used with Xenstore [2], which is a different use-case (there are other examples in the readme of the Irmin repo).

[1] https://github.com/talex5/cuekeeper

[2] https://github.com/djs55/ocaml-xenstore/tree/irminsule

amirmcon Irmin: Git-like distributed DB

Seems to be fine now.

amirmcon Irmin: Git-like distributed DB

There was some discussion about Irmin just over a year ago [1] and it's been steadily improving ever since. The Readme on the repo [2] lists the bleeding-edge users too, so you can see examples of how it's been applied -- (note to self: we should probably write an update about the progress to date).

[1] https://news.ycombinator.com/item?id=8053687

[2] https://github.com/mirage/irmin/blob/master/README.md#use-ca...

amirmcon Twitter announces layoffs

Reading that just indicates that the world needs social media, not Twitter per se. Many of the quotes there seem to indicate that Twitter's role was exaggerated.