click VS wayfinder

It's possible to create an IPSec + firewall based on the Click Modular Router[0] and run this on top of Unikraft[1].

[0]: https://github.com/kohler/click/wiki/IPsecEncap (and other IPSec* elements)

[1]: https://github.com/unikraft/app-click

It could make for an interesting tutorial with a full Click-based IPSec router though! :)

Many unikernel projects were ahead of their time. For example ClickOS [0] is ~7 years old but all its ideas still sound innovative. Someone could build an entire business on top of network function virtualization, using unikernels as an efficient sandboxing mechanism.

I’m not sure why unikernels have not caught on widely. I suspect their time has yet to come for some applications, but at least for NFV and sandboxing, I would bet on solutions using eBPF or XDP with WASM for sandboxing.

[0] https://github.com/kohler/click

Source: https://github.com/kohler/click/blob/6fa978f0188bd0b8a266f65...

Context: This is the source code of the Click Modular Router, a system for implementing packet processing logic with a graph-like DSL. Both primitives, and certain complex logic, are implemented in C++; however, as this has to be able to run as a Linux kernel module, it can't use the C++ standard library, and has its own stdlib.

1. We build unikernels using the 'kraft container' which is Docker/OCI image[0][1] which has the necessary build tools to build Unikraft unikernels. We plug this into Concourse which builds thousands of combinations of Unikernels[2] as part of our code review process[3]. In addition to this, we have on-going research and tooling to help automatically discover permutations of Unikernel builds[4].

2. Really great question, but mostly you can expect the same functionality of an application when it runs as a unikernel because the application "thinks" it's still running in a traditional OS environment -- as it should be. Check out this documentation[5] (after step 7) about porting, it has snippets about where the boundary sometimes breaks.

3. Well, general-purposes are not suited for deployment environments. Installing Gentoo (or Ubuntu, Debian, for that matter) is a waste of resources if you only SSH in once to install your desired application.

[0]: https://unikraft.org/docs/usage/install/#docker

[1]: https://github.com/unikraft/kraft/tree/staging/package/docke...

[2]: https://builds.unikraft.io

[3]: https://unikraft.org/docs/contributing/review-process/#stage...

[4]: https://github.com/lancs-net/wayfinder

[5]: https://unikraft.org/docs/develop/porting/#providing-build-f...