unikernel

A unikernel is a specialized single-address-space machine image constructed by combining an application with a minimal library operating system. The result is a standalone executable that runs directly on a hypervisor or on bare hardware, without a traditional, general-purpose operating system.

Unlike conventional operating systems that run many processes atop a kernel, a unikernel includes only the components required by the target application and compiles them together into one image. The library operating system provides essential services such as networking, file systems, drivers, and process or thread management, but the application code is tightly coupled to these services. Because there is typically a single address space, context switches are minimized and system calls are reduced.

Building a unikernel often involves selecting a minimal interface set (the library OS) and compiling the app against it. The resulting binary can boot rapidly and consumes little memory, with a small attack surface due to the absence of a large, general-purpose OS.

Deployment and execution: unikernels run inside a virtual machine monitor such as KVM, Xen, or on bare metal or specialized firmware; they are popular in cloud and edge environments where fast startup and predictable resource usage are valuable. They can provide high performance for networked services and microservices.

Limitations and challenges: development, debugging, and portability can be difficult because the application and OS components are tightly integrated and platform-specific. Toolchains and ecosystems are smaller than those for conventional operating systems, and integrating drivers or third-party libraries can be nontrivial.

Notable projects include MirageOS (OCaml), IncludeOS, Unikraft, and Rumprun, which demonstrate the breadth of approaches to building unikernels for different languages and runtimes.