unikernels were hard. key word: were.

If you deeply care about security, there are really two choices: You're sending satellites into space, and you should probably use seL4, a formally verified operating system. (I'm still a bit salty about the Australian government disbanding that team.) Everyone else should seriously consider unikernels. Stop trying to harden something that is very hackable. Invert it and design from the other direction. — Geoffrey Huntley in unikernels were hard. key word: were. I have been a fan of Unikernels since MirageOS was announced, but OCaml was always an issue, mostly because of the lack of libraries for unikernels, but also because of the double semicolon (sorry Jane Streeters, French people and CMUers). In the age of agents, unikernels make sense to isolate agent tasks so that they have as little (security-attackable) surface as possible, finish as fast as possible, and you can run as many in a single machine as possible. However, you need some kind of inter-unikernel communication protocol…