[HN Gopher] MirageOS 4.0 - Self-managed internet infrastructure ...
       ___________________________________________________________________
        
       MirageOS 4.0 - Self-managed internet infrastructure with unikernels
        
       Author : kirschner
       Score  : 151 points
       Date   : 2022-03-29 09:42 UTC (13 hours ago)
        
 (HTM) web link (mirage.io)
 (TXT) w3m dump (mirage.io)
        
       | osener wrote:
       | There's a fantastic episode of Signals & Threads podcast about
       | MirageOS's roots, Xen Hypervisor and more with Anil Madhavapeddy
       | as the guest. I found it very thought provoking:
       | https://signalsandthreads.com/what-is-an-operating-system/
        
       | onebot wrote:
       | I am fascinated by Unikernels. But how do they deal with things
       | that need to fork or run multiple processes? Aren't they
       | restricted to single processes?
        
         | avsm wrote:
         | This all started because we wanted to _get away_ from the need
         | to fork or run multiple processes, since that's so hard in a
         | variety of hardware architectures (like mobile or embedded).
         | 
         | Other researchers also share the dislike of fork...
         | https://www.microsoft.com/en-us/research/uploads/prod/2019/0...
         | 
         | A 2010 paper where I sketched out some of the early ideas
         | around "multiscale" is here:
         | https://anil.recoil.org/papers/2010-bcs-visions.pdf
         | 
         | It took a little longer than I'd planned, but thanks to the
         | hard work of so many MirageOS contributors, now's a pretty good
         | time to glue back personal containers and self-hosted data
         | management infrastructure again! Unikernel-based messaging has
         | really come together in the past couple of years:
         | https://tarides.com/blog/2022-03-08-secure-virtual-messages-...
        
         | hannesm wrote:
         | We use asynchronous tasks in MirageOS (cooperative
         | multitasking) using lwt
         | http://ocsigen.org/lwt/latest/manual/manual, so you can serve
         | multiple network connections at the same time.
         | 
         | Since there are no processes, there's no concept of "fork", but
         | indeed you can run multiple tasks at the same time (using the
         | same address space). Why again would you need multiple
         | processes? Since the programming language OCaml has a semantics
         | and is memory-safe, there's no strong reason for isolation at
         | execution time (apart from the C bits, which we try to keep to
         | a minimum and compile with runtime safety flags (red-zone for
         | stack protection, mapping execute-only (seems to only reliably
         | work on OpenBSD), etc.)).
        
           | scns wrote:
           | Conurrency instead of parallelism.
        
             | wmf wrote:
             | No amount of concurrency on a single core can equal the
             | performance of multiple cores.
        
               | cestith wrote:
               | You can run more than one unikernel per machine. That's
               | why things like KVM or Bhyve are targets instead of just
               | bare metal.
        
               | pjmlp wrote:
               | That is why you deploy a process per core, with affinity
               | so that it doesn't jump around.
        
           | asymmetric wrote:
           | Is this also how you deal with logging/monitoring?
           | 
           | Do you have a concept of logging daemon? How would I run
           | prometheus exporter-like things?
           | 
           | Is there a FAQ where questions along these lines are
           | answered?
        
             | hannesm wrote:
             | Maybe https://hannes.robur.coop/Posts/Monitoring sheds some
             | light how to monitor MirageOS unikernels ;)
        
             | avsm wrote:
             | Just substitute 'microservice' with 'unikernel' and you do
             | broadly the same things. There's a prometheus library that
             | you link with the MirageOS unikernel and it exports using
             | that: https://github.com/mirage/prometheus
             | 
             | No FAQ for this sort of thing yet, but we should start
             | assembling one sometime soon. Questions like this very
             | welcome on the discussion forums:
             | https://discuss.ocaml.org/t/ann-mirageos-4-0/9598 to help
             | us get started.
             | 
             | There's a nice collection of unikernels over at:
             | https://github.com/roburio/unikernels and
             | https://github.com/tarides/unikernels for various
             | infrastructure pieces (like https, smtp, dns, ip filters,
             | etc) that are good to crib from for your own
             | infrastructure.
        
           | gpderetta wrote:
           | What about multiprocessing? I assume that MirageOS can take
           | advantage of multiple cores (or do you need separate
           | instances per core?). In this case is the system still shared
           | memory?
           | 
           | Also I would say there are reasons for isolation beyond
           | memory safety.
        
             | hannesm wrote:
             | MirageOS is - similar to the latest OCaml release - only
             | using a single CPU core. You can run multiple unikernels,
             | one on each core. If doing that, you can use Xen vchan
             | (shared memory), or TCP for marshalling.
             | 
             | > Also I would say there are reasons for isolation beyond
             | memory safety.
             | 
             | Would you mind to elaborate which reasons you are thinking
             | of?
        
               | 0xbkt wrote:
               | > only using a single CPU core
               | 
               | How does it go when you deploy a unikernel on EC2 (or on
               | any IaaS where the hypervisor is managed unlike bare-
               | metal) with multiple cores? Is there a way to start a
               | unikernel per core on a single instance, or are you bound
               | to use single core instance types only?
        
         | rwmj wrote:
         | Unikernel Linux (UKL - https://github.com/unikernellinux)
         | actually does allow you to fork. The main unikernel program
         | runs in kernel space linked to Linux, and after a fork you get
         | a new, regular userspace process.
        
         | sanxiyn wrote:
         | Yes they are, but you don't need to fork for a lot of
         | workloads.
        
         | actionfromafar wrote:
         | The new version of OCaml got multiprocessor support recently.
         | 
         | https://www.infoq.com/news/2021/10/ocaml-5-multicore/
        
       | laurensr wrote:
       | This name is associated with a lot of nostalgia for me, as it is
       | the same name as the shell launcher for Texas Instruments'
       | TI-83/84 graphing calculators.
        
         | Flameancer wrote:
         | I was about to mention the same thing. Theses appear to be
         | completely unrelated projects. And here I was about to dust of
         | the old TI-84 to try it out.
        
         | jychang wrote:
         | I was wondering why the name sounded familiar. For a second I
         | thought this was referring to ReactOS, which is something else
         | completely different.
        
       | mindwok wrote:
       | This project mentions it's based on the Xen hypervisor and uses
       | EC2 as an example for running it, but haven't AWS now moved to
       | their own KVM based hypervisor? Would this still work?
        
         | detaro wrote:
         | You can still choose Xen-based instances in EC2.
        
           | wmf wrote:
           | This isn't good advice. People should probably use the hvt
           | backend on AWS.
        
           | mindwok wrote:
           | Ahh ok. I imagine you would lose all the nice Nitro stuff
           | though like enhanced networking etc which is a bummer.
        
             | Dunedan wrote:
             | There is Xen-on-Nitro, which AWS developed to continue to
             | support customers using Xen to run on EC2 instances
             | featuring Nitro:
             | https://perspectives.mvdirona.com/2021/11/xen-on-nitro-
             | aws-n...
        
               | mindwok wrote:
               | That's great to know, thank you
        
         | hannesm wrote:
         | In ancient times, only Xen was supported. Nowadays, the support
         | moved to:                 - Xen (PVH)       - Linux KVM,
         | FreeBSD BHyve, OpenBSD VMM       - SPT (seccomp, no hardware
         | virtualization)       - virtio (GCE, ..)       - muen (muen.sk)
         | 
         | Take a look at https://github.com/solo5/solo5 which is used as
         | the low level bits to run OCaml.
        
           | mwcampbell wrote:
           | > - SPT (seccomp, no hardware virtualization)
           | 
           | To be clear, this means running an ordinary Linux binary,
           | right?
           | 
           | I'm curious about the remaining advantages in practice of
           | running multiple processes on a shared kernel rather than
           | using hardware virtualization. I guess the main one is more
           | efficient resource pooling, particularly memory and the page
           | cache. I understand the primary advantage of virtualization
           | is a smaller attack surface.
        
             | cestith wrote:
             | One of the stated advantages various places of having a
             | unikernel build as a regular ELF binary on Linux or BSD
             | (including the semi-BSD macOS) is that you can use it as
             | your instrumented debug build very easily. Yes, you can
             | instrument your app heavily. You can have console output.
             | You can log to a mounted volume, to an object store, or to
             | a remote log server with rsyslog or something like Elastic.
             | But with an ELF binary on an OS you can strace, dtrace,
             | fence it, run it under gdb or another debugger, instrument
             | the OS under it, or whatever. Then the same source code
             | builds essentially the same program to run right on KVM or
             | Xen with no OS under it for security and efficiency.
        
             | hannesm wrote:
             | Yes, this is an ordinary Linux binary.
             | 
             | The attack surface is different, you may be interested in h
             | ttps://archive.fosdem.org/2019/schedule/event/solo5_unikern
             | ... and/or https://archive.fosdem.org/2019/schedule/event/s
             | olo5_unikern... :)
             | 
             | TL;DR: hardware virtualization is pushing trust into
             | hardware -- but can you trust the hardware implementation
             | (to isolate memory)?
        
       | lokedhs wrote:
       | MirageOS is really interested when combined with Qubes OS. I've
       | started looking at MirageOS, and since I use Qubes, being able to
       | run things directly on Xen right next to my regular VM's is
       | really neat.
       | 
       | There are also projects to replace sys-firewall with a MirageOS
       | unikernel instead. That's something that seems very interesting.
        
         | imachine1980_ wrote:
         | Qubes OS?
        
           | kirschner wrote:
           | Have a look at https://www.qubes-os.org/ It is a Free
           | Software operating system with the focus on security.
        
             | fsflover wrote:
             | Recent discussion:
             | https://news.ycombinator.com/item?id=30776103.
        
       | pbronez wrote:
       | Does MirageOS exclusively support native Ocaml applications? Or
       | does it appear to applications like a standard OS, so you can
       | develop with anything?
       | 
       | For example, they show how you can host a static site. Great, but
       | can I run my Flask API?
        
       ___________________________________________________________________
       (page generated 2022-03-29 23:01 UTC)