lk VS qubes-mirage-firewall

This is based on little kernel from recollection (noted somewhere in the docs)

https://github.com/littlekernel/lk

I've worked in LK (Little Kernel), which is the basis of the Android and WebOS boot loaders, but is also a reasonable stand-alone operating system, ThreadX, which is a very lightweight RTOS, and one or two others. These were all written in C, but it was also quite a few years ago, so I suspect a good chunk of the industry has moved to C++.

You might also want to look into LK ("little kernel"). It's the basis for both the Android and WebOS bootloaders, which I've also worked on. It has multi-threading and I/O but doesn't support user processes. Might be good for embedded systems.

what about LK ?

2) https://github.com/mirage/qubes-mirage-firewall is by far a better firewall for Qubes than OpenBSD ever will be - unikernels are far more secure than a traditional operating system is and you can read all about it on https://mirageos.org/

That's correct. It does mean that the closest to a self-contained program you can run is a unikernel like the mirage-firewall, unfortunately. On the upside, those remain easily portable to essentially anything that can run VMs so long as you adjust the image format.

That sounds similar to a unikernel. There are actual uses for those in seL4 and Qubes OS such as a firewall-qube (in theory unikernel qubes should be able to take far less system resources to run than full Linux+distro qubes).

Here's one that is "production" ready: the Mirage-Firewall microkernel running on Qubes OS.[0]

[0] : https://github.com/mirage/qubes-mirage-firewall

sys-net, sys-firewall and other administrative vms should slowly migrate to unikernels instead of running linux, which should help with ram usage. The mirage.io project seems to build a couple qubes vms, for example https://github.com/mirage/qubes-mirage-firewall is a firewall which they indicate to give 64Mb of ram.