[HN Gopher] MirageOS 4.0 - Self-managed internet infrastructure ...
___________________________________________________________________
MirageOS 4.0 - Self-managed internet infrastructure with unikernels
Author : kirschner
Score : 151 points
Date : 2022-03-29 09:42 UTC (13 hours ago)
(HTM) web link (mirage.io)
(TXT) w3m dump (mirage.io)
| osener wrote:
| There's a fantastic episode of Signals & Threads podcast about
| MirageOS's roots, Xen Hypervisor and more with Anil Madhavapeddy
| as the guest. I found it very thought provoking:
| https://signalsandthreads.com/what-is-an-operating-system/
| onebot wrote:
| I am fascinated by Unikernels. But how do they deal with things
| that need to fork or run multiple processes? Aren't they
| restricted to single processes?
| avsm wrote:
| This all started because we wanted to _get away_ from the need
| to fork or run multiple processes, since that's so hard in a
| variety of hardware architectures (like mobile or embedded).
|
| Other researchers also share the dislike of fork...
| https://www.microsoft.com/en-us/research/uploads/prod/2019/0...
|
| A 2010 paper where I sketched out some of the early ideas
| around "multiscale" is here:
| https://anil.recoil.org/papers/2010-bcs-visions.pdf
|
| It took a little longer than I'd planned, but thanks to the
| hard work of so many MirageOS contributors, now's a pretty good
| time to glue back personal containers and self-hosted data
| management infrastructure again! Unikernel-based messaging has
| really come together in the past couple of years:
| https://tarides.com/blog/2022-03-08-secure-virtual-messages-...
| hannesm wrote:
| We use asynchronous tasks in MirageOS (cooperative
| multitasking) using lwt
| http://ocsigen.org/lwt/latest/manual/manual, so you can serve
| multiple network connections at the same time.
|
| Since there are no processes, there's no concept of "fork", but
| indeed you can run multiple tasks at the same time (using the
| same address space). Why again would you need multiple
| processes? Since the programming language OCaml has a semantics
| and is memory-safe, there's no strong reason for isolation at
| execution time (apart from the C bits, which we try to keep to
| a minimum and compile with runtime safety flags (red-zone for
| stack protection, mapping execute-only (seems to only reliably
| work on OpenBSD), etc.)).
| scns wrote:
| Conurrency instead of parallelism.
| wmf wrote:
| No amount of concurrency on a single core can equal the
| performance of multiple cores.
| cestith wrote:
| You can run more than one unikernel per machine. That's
| why things like KVM or Bhyve are targets instead of just
| bare metal.
| pjmlp wrote:
| That is why you deploy a process per core, with affinity
| so that it doesn't jump around.
| asymmetric wrote:
| Is this also how you deal with logging/monitoring?
|
| Do you have a concept of logging daemon? How would I run
| prometheus exporter-like things?
|
| Is there a FAQ where questions along these lines are
| answered?
| hannesm wrote:
| Maybe https://hannes.robur.coop/Posts/Monitoring sheds some
| light how to monitor MirageOS unikernels ;)
| avsm wrote:
| Just substitute 'microservice' with 'unikernel' and you do
| broadly the same things. There's a prometheus library that
| you link with the MirageOS unikernel and it exports using
| that: https://github.com/mirage/prometheus
|
| No FAQ for this sort of thing yet, but we should start
| assembling one sometime soon. Questions like this very
| welcome on the discussion forums:
| https://discuss.ocaml.org/t/ann-mirageos-4-0/9598 to help
| us get started.
|
| There's a nice collection of unikernels over at:
| https://github.com/roburio/unikernels and
| https://github.com/tarides/unikernels for various
| infrastructure pieces (like https, smtp, dns, ip filters,
| etc) that are good to crib from for your own
| infrastructure.
| gpderetta wrote:
| What about multiprocessing? I assume that MirageOS can take
| advantage of multiple cores (or do you need separate
| instances per core?). In this case is the system still shared
| memory?
|
| Also I would say there are reasons for isolation beyond
| memory safety.
| hannesm wrote:
| MirageOS is - similar to the latest OCaml release - only
| using a single CPU core. You can run multiple unikernels,
| one on each core. If doing that, you can use Xen vchan
| (shared memory), or TCP for marshalling.
|
| > Also I would say there are reasons for isolation beyond
| memory safety.
|
| Would you mind to elaborate which reasons you are thinking
| of?
| 0xbkt wrote:
| > only using a single CPU core
|
| How does it go when you deploy a unikernel on EC2 (or on
| any IaaS where the hypervisor is managed unlike bare-
| metal) with multiple cores? Is there a way to start a
| unikernel per core on a single instance, or are you bound
| to use single core instance types only?
| rwmj wrote:
| Unikernel Linux (UKL - https://github.com/unikernellinux)
| actually does allow you to fork. The main unikernel program
| runs in kernel space linked to Linux, and after a fork you get
| a new, regular userspace process.
| sanxiyn wrote:
| Yes they are, but you don't need to fork for a lot of
| workloads.
| actionfromafar wrote:
| The new version of OCaml got multiprocessor support recently.
|
| https://www.infoq.com/news/2021/10/ocaml-5-multicore/
| laurensr wrote:
| This name is associated with a lot of nostalgia for me, as it is
| the same name as the shell launcher for Texas Instruments'
| TI-83/84 graphing calculators.
| Flameancer wrote:
| I was about to mention the same thing. Theses appear to be
| completely unrelated projects. And here I was about to dust of
| the old TI-84 to try it out.
| jychang wrote:
| I was wondering why the name sounded familiar. For a second I
| thought this was referring to ReactOS, which is something else
| completely different.
| mindwok wrote:
| This project mentions it's based on the Xen hypervisor and uses
| EC2 as an example for running it, but haven't AWS now moved to
| their own KVM based hypervisor? Would this still work?
| detaro wrote:
| You can still choose Xen-based instances in EC2.
| wmf wrote:
| This isn't good advice. People should probably use the hvt
| backend on AWS.
| mindwok wrote:
| Ahh ok. I imagine you would lose all the nice Nitro stuff
| though like enhanced networking etc which is a bummer.
| Dunedan wrote:
| There is Xen-on-Nitro, which AWS developed to continue to
| support customers using Xen to run on EC2 instances
| featuring Nitro:
| https://perspectives.mvdirona.com/2021/11/xen-on-nitro-
| aws-n...
| mindwok wrote:
| That's great to know, thank you
| hannesm wrote:
| In ancient times, only Xen was supported. Nowadays, the support
| moved to: - Xen (PVH) - Linux KVM,
| FreeBSD BHyve, OpenBSD VMM - SPT (seccomp, no hardware
| virtualization) - virtio (GCE, ..) - muen (muen.sk)
|
| Take a look at https://github.com/solo5/solo5 which is used as
| the low level bits to run OCaml.
| mwcampbell wrote:
| > - SPT (seccomp, no hardware virtualization)
|
| To be clear, this means running an ordinary Linux binary,
| right?
|
| I'm curious about the remaining advantages in practice of
| running multiple processes on a shared kernel rather than
| using hardware virtualization. I guess the main one is more
| efficient resource pooling, particularly memory and the page
| cache. I understand the primary advantage of virtualization
| is a smaller attack surface.
| cestith wrote:
| One of the stated advantages various places of having a
| unikernel build as a regular ELF binary on Linux or BSD
| (including the semi-BSD macOS) is that you can use it as
| your instrumented debug build very easily. Yes, you can
| instrument your app heavily. You can have console output.
| You can log to a mounted volume, to an object store, or to
| a remote log server with rsyslog or something like Elastic.
| But with an ELF binary on an OS you can strace, dtrace,
| fence it, run it under gdb or another debugger, instrument
| the OS under it, or whatever. Then the same source code
| builds essentially the same program to run right on KVM or
| Xen with no OS under it for security and efficiency.
| hannesm wrote:
| Yes, this is an ordinary Linux binary.
|
| The attack surface is different, you may be interested in h
| ttps://archive.fosdem.org/2019/schedule/event/solo5_unikern
| ... and/or https://archive.fosdem.org/2019/schedule/event/s
| olo5_unikern... :)
|
| TL;DR: hardware virtualization is pushing trust into
| hardware -- but can you trust the hardware implementation
| (to isolate memory)?
| lokedhs wrote:
| MirageOS is really interested when combined with Qubes OS. I've
| started looking at MirageOS, and since I use Qubes, being able to
| run things directly on Xen right next to my regular VM's is
| really neat.
|
| There are also projects to replace sys-firewall with a MirageOS
| unikernel instead. That's something that seems very interesting.
| imachine1980_ wrote:
| Qubes OS?
| kirschner wrote:
| Have a look at https://www.qubes-os.org/ It is a Free
| Software operating system with the focus on security.
| fsflover wrote:
| Recent discussion:
| https://news.ycombinator.com/item?id=30776103.
| pbronez wrote:
| Does MirageOS exclusively support native Ocaml applications? Or
| does it appear to applications like a standard OS, so you can
| develop with anything?
|
| For example, they show how you can host a static site. Great, but
| can I run my Flask API?
___________________________________________________________________
(page generated 2022-03-29 23:01 UTC)