hermitux VS click

unikernels maybe. e.g. there is HermiTux

The definition of what a unikernel is needs to be narrowed down, a lot of these projects in the space (not all the ones listed above) have material differences that are not clear:

- some run only one language

- some require recompilation

- some essentially swap out libraries, others do something closer to dropping your already mostly static binary in a minimal disk image

- some build pid1 processes, others VMs images

Anyway, here are some additional entries in the space:

- https://ssrg-vt.github.io/hermitux/

- https://github.com/linuxkit/linuxkit (more embedded/minimal VM than unikernel)

- https://nabla-containers.github.io/ (runs on Solo5)

I am going through using Linuxkit to build AMIs for cloud providers now. I wouldn’t necessarily class linuxkit as a universal project because it doesn’t have the hallmark blurring of user and kernel space or kernel-as-a-library but you can customize the kernel so it’s an adjacent idea, and I think it’s the one most likely to be in actual use at non-hyperscalers.

What do you think of this, then? https://github.com/ssrg-vt/hermitux/wiki/Fast-system-calls-i...

I just had this in mind because skimmed it a few hours ago in the context of https://news.ycombinator.com/item?id=26142285

It's possible to create an IPSec + firewall based on the Click Modular Router[0] and run this on top of Unikraft[1].

[0]: https://github.com/kohler/click/wiki/IPsecEncap (and other IPSec* elements)

[1]: https://github.com/unikraft/app-click

It could make for an interesting tutorial with a full Click-based IPSec router though! :)

Many unikernel projects were ahead of their time. For example ClickOS [0] is ~7 years old but all its ideas still sound innovative. Someone could build an entire business on top of network function virtualization, using unikernels as an efficient sandboxing mechanism.

I’m not sure why unikernels have not caught on widely. I suspect their time has yet to come for some applications, but at least for NFV and sandboxing, I would bet on solutions using eBPF or XDP with WASM for sandboxing.

[0] https://github.com/kohler/click

Source: https://github.com/kohler/click/blob/6fa978f0188bd0b8a266f65...

Context: This is the source code of the Click Modular Router, a system for implementing packet processing logic with a graph-like DSL. Both primitives, and certain complex logic, are implemented in C++; however, as this has to be able to run as a Linux kernel module, it can't use the C++ standard library, and has its own stdlib.