skip to main content
10.1145/3313808.3313817acmconferencesArticle/Chapter ViewAbstractPublication PagesveeConference Proceedingsconference-collections
research-article
Public Access

A binary-compatible unikernel

Published: 14 April 2019 Publication History

Abstract

Unikernels are minimal single-purpose virtual machines. They are highly popular in the research domain due to the benefits they provide. A barrier to their widespread adoption is the difficulty/impossibility to port existing applications to current unikernels. HermiTux is the first unikernel providing binary-compatibility with Linux applications. It is composed of a hypervisor and lightweight kernel layer emulating OS interfaces at load- and runtime in accordance with the Linux ABI. HermiTux relieves application developers from the burden of porting software, while providing unikernel benefits such as security through hardware-assisted virtualized isolation, swift boot time, and low disk/memory footprint. Fast system calls and kernel modularity are enabled through binary rewriting and analysis techniques, as well as shared library substitution. Compared to other unikernels, HermiTux boots faster and has a lower memory/disk footprint. We demonstrate that over a range of native C/C++/Fortran/Python Linux applications, HermiTux performs similarly to Linux in most cases: its performance overhead averages 3% in memory- and compute-bound scenarios.

References

[1]
Andrea Arcangeli, Izik Eidus, and Chris Wright. 2009. Increasing memory density by using KSM. In Proceedings of the linux symposium. Citeseer, 19–28.
[2]
Sergei Arnautov, Bohdan Trach, Franz Gregor, Thomas Knauth, Andre Martin, Christian Priebe, Joshua Lind, Divya Muthukumaran, Dan O’keeffe, Mark Stillwell, and others. 2016. SCONE: Secure Linux Containers with Intel SGX. In OSDI, Vol. 16. 689–703.
[3]
David H Bailey, Eric Barszcz, John T Barton, David S Browning, Robert L Carter, Leonardo Dagum, Rod A Fatoohi, Paul O Frederickson, Thomas A Lasinski, Rob S Schreiber, and others. 1991. The NAS parallel benchmarks. The International Journal of Supercomputing Applications 5, 3 (1991), 63–73.
[4]
Adam Belay, Andrea Bittau, Ali José Mashtizadeh, David Terei, David Mazières, and Christos Kozyrakis. 2012. Dune: Safe User-level Access to Privileged CPU Features. In Osdi, Vol. 12. 335–348.
[5]
Fabrice Bellard. 2005. QEMU, a fast and portable dynamic translator. In USENIX Annual Technical Conference, FREENIX Track. 41–46.
[6]
Christian Bienia, Sanjeev Kumar, Jaswinder Pal Singh, and Kai Li. 2008. The PARSEC benchmark suite: Characterization and architectural implications. In Proceedings of the 17th international conference on Parallel architectures and compilation techniques. ACM, 72–81.
[7]
Sören Bleikertz. 2011. How to run Redis natively on Xen. (2011). https:// openfoo.org/blog/redis-native-xen.html . Online, accessed 11/27/2017.
[8]
Alfred Bratterud, Alf-Andre Walla, Hårek Haugerud, Paal E Engelstad, and Kyrre Begnum. 2015. IncludeOS: A minimal, resource efficient unikernel for cloud services. In Proceedings of the 7th IEEE International Conference on Cloud Computing Technology and Science (CloudCom 2015). IEEE, 250–257.
[9]
Cloudozer LLP. 2017. LING/Erlang on Xen website. (2017). http: //erlangonxen.org/ . Online, accessed 11/20/2017.
[10]
Christian S Collberg, John H Hartman, Sridivya Babu, and Sharath K Udupa. 2005. SLINKY: Static Linking Reloaded. In USENIX Annual Technical Conference, General Track. 309–322.
[11]
Jonathan Corbet. 2009. Seccomp and sandboxing. LWN. net, May 25 (2009).
[12]
Jonathan Corbet. 2011. On vsyscall and the vDSO. (2011). https: //lwn.net/Articles/446528/, Online, accessed 08/05/2018.
[13]
Intel Corp. 2018. Intel Clear Containers. (2018). https://clearlinux.org/ documentation/clear-containers . Online, accessed 08/04/2018.
[14]
Vittorio Cozzolino, Aaron Yi Ding, and Jörg Ott. 2017. FADES: FineGrained Edge Offloading with Unikernels. In Proceedings of the Workshop on Hot Topics in Container Networking and Networked Systems (HotConNet’17). ACM, 36–41.
[15]
Will Dietz and Vikram Adve. 2018. Software multiplexing: share your libraries and statically link them too. Proceedings of the ACM on Programming Languages 2, OOPSLA (2018), 154.
[16]
Bob Duncan, Andreas Happe, and Alfred Bratterud. 2016. Enterprise IoT security and scalability: how unikernels can improve the status Quo. In IEEE/ACM 9th International Conference on Utility and Cloud Computing (UUC 2016). IEEE, 292–297.
[17]
ELF 2015. Executable and Linking Format (ELF). (2015). http://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-AMD64/ LSB-Core-AMD64/elf-amd64.html . Online, accessed 11/24/2017.
[18]
Wes Felter, Alexandre Ferreira, Ram Rajamony, and Juan Rubio. 2015. An updated performance comparison of virtual machines and linux containers. In Performance Analysis of Systems and Software (ISPASS), 2015 IEEE International Symposium On. IEEE, 171–172.
[19]
Google. 2018. Gvisor Github webpage. (2018). https://github.com/ google/gvisor, Online, accessed 05/03/2018.
[20]
Daniel Gruss, Julian Lettner, Felix Schuster, Olya Ohrimenko, Istvan Haller, and Manuel Costa. 2017. Strong and efficient cache side-channel protection using hardware transactional memory. In USENIX Security Symposium. 217–233.
[21]
Hacker News 2017. Unikernels are Secure. (2017). https://news. ycombinator.com/item?id=14736909 . Online, accessed 11/27/2017.
[22]
Intel Corporation. 2017. Intel 64 and IA-32 Architectures Software Developer Manual. (2017).
[23]
Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. 2015. Obfuscator-LLVM – Software Protection for the Masses. In Proceedings of the IEEE/ACM 1st International Workshop on Software Protection (SPRO’15), Brecht Wyseur (Ed.). IEEE, 3–9.
[24]
Antti Kantee and Justin Cormack. 2014. Rump Kernels No OS? No Problem! USENIX; login: magazine (2014).
[25]
Jeffrey Katcher. 1997. Postmark: A new file system benchmark. Technical Report. Technical Report TR3022, Network Appliance.
[26]
Vasileios P Kemerlis, Michalis Polychronakis, and Angelos D Keromytis. 2014. ret2dir: Rethinking Kernel Isolation. In USENIX Security Symposium. 957–972.
[27]
Vasileios P Kemerlis, Georgios Portokalidis, and Angelos D Keromytis. 2012. kGuard: Lightweight Kernel Protection against Return-to-User Attacks. In USENIX Security Symposium, Vol. 16.
[28]
Avi Kivity, Dor Laor Glauber Costa, and Pekka Enberg. 2014. OS v -Optimizing the Operating System for Virtual Machines. In Proceedings of the 2014 USENIX Annual Technical Conference (ATC’14). 61.
[29]
Michał Król and Ioannis Psaras. 2017. NFaaS: named function as a service. In Proceedings of the 4th ACM Conference on InformationCentric Networking. ACM, 134–144.
[30]
Simon Kuenzer, Anton Ivanov, Filipe Manco, Jose Mendes, Yuri Volchkov, Florian Schmidt, Kenichi Yasukata, Michio Honda, and Felipe Huici. 2017. Unikernels Everywhere: The Case for Elastic CDNs. In Proceedings of the 13th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE’17). ACM, 15–29.
[31]
Stefan Lankes, Simon Pickartz, and Jens Breitbart. 2016. HermitCore: a unikernel for extreme scale computing. In Proceedings of the 6th International Workshop on Runtime and Operating Systems for Supercomputers (ROSS 2016). ACM.
[32]
S. Lankes, S. Pickartz, and J. Breitbart. 2017. A Low Noise Unikernel for Extrem-Scale Systems. Springer International Publishing, Cham, 73–84.
[33]
Chris Lattner and Vikram Adve. 2004. LLVM: A compilation framework for lifelong program analysis & transformation. In Proceedings of the international symposium on Code generation and optimization: feedback-directed and runtime optimization. IEEE Computer Society, 75.
[34]
Julia Lawall and Gilles Muller. 2018. Coccinelle: 10 years of automated evolution in the Linux kernel. In 2018 {USENIX} Annual Technical Conference ({USENIX} {ATC} 18). 601–614.
[35]
Linux Kernel Contributors 2017. Linux kernel documentation: x86_64 memory map. (2017). http://elixir.free-electrons.com/linux/ v4.14.2/source/Documentation/x86/x86_64/mm.txt, Online, accessed 11/24/2017.
[36]
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown. ArXiv e-prints (Jan. 2018). arXiv: 1801.01207
[37]
Wei Liu. 2013. Improving Scalability of Xen: the 3000 Domains Experiment. Collaboration Summit. (2013). https://events.static.linuxfound. org/images/stories/slides/lfcs2013_liu.pdf
[38]
LWIP 2017. LWIP Website. (2017). https://savannah.nongnu.org/ projects/lwip/ . Online, accessed 12/12/2017.
[39]
Anil Madhavapeddy, Thomas Leonard, Magnus Skjegstad, Thomas Gazagnaire, David Sheets, David J Scott, Richard Mortier, Amir Chaudhry, Balraj Singh, Jon Ludlam, and others. 2015. Jitsu: JustIn-Time Summoning of Unikernels. In Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI’15). 559–573.
[40]
A Madhavapeddy, R Mortier, C Rotsos, DJ Scott, B Singh, T Gazagnaire, S Smith, S Hand, and J Crowcroft. 2013. Unikernels: library operating systems for the cloud. In Proceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS’13). ACM, 461–472.
[41]
Filipe Manco, Costin Lupu, Florian Schmidt, Jose Mendes, Simon Kuenzer, Sumit Sati, Kenichi Yasukata, Costin Raiciu, and Felipe Huici. 2017. My VM is Lighter (and Safer) Than Your Container. In Proceedings of the 26th Symposium on Operating Systems Principles (SOSP ’17). ACM, New York, NY, USA, 218–233.
[42]
Joao Martins, Mohamed Ahmed, Costin Raiciu, Vladimir Olteanu, Michio Honda, Roberto Bifulco, and Felipe Huici. 2014. ClickOS and the Art of Network Function Virtualization. In Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation (NSDI’14). USENIX Association, Berkeley, CA, USA, 459–473. http: //dl.acm.org/citation.cfm?id=2616448.2616491
[43]
Michael Matz, Jan Hubicka, Andreas Jaeger, and Mark Mitchell. 2013. System V Application Binary Interface. AMD64 Architecture Processor Supplement, Draft v0 99 (2013).
[44]
Larry W McVoy, Carl Staelin, and others. 1996. lmbench: Portable Tools for Performance Analysis. In USENIX annual technical conference. San Diego, CA, USA, 279–294.
[45]
Dirk Merkel. 2014. Docker: lightweight linux containers for consistent development and deployment. Linux Journal 2014, 239 (2014), 2.
[46]
Daniel Micay. 2018. Linux ASLR Comparison. (2018). https://gist. github.com/thestinger/b43b460cfccfade51b5a2220a0550c35, Online, accessed 12/12/2018.
[47]
Micropython Contributors. 2018. Micropython webpage. (2018). https: //micropython.org/, Online, accessed 08/05/2018.
[48]
Newlib 2017. Newlib Website. (2017). https://sourceware.org/newlib/ . Online, accessed 12/12/2017.
[49]
Vlad Nitu, Pierre Olivier, Alain Tchana, Daniel Chiba, Antonio Barbalace, Daniel Hagimont, and Binoy Ravindran. 2017. Swift Birth and Quick Death: Enabling Fast Parallel Guest Boot and Destruction in the Xen Hypervisor. In Proceedings of the 13th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE ’17). ACM, New York, NY, USA, 1–14.
[50]
OSv Contributors. 2013. OSv - execve(2) support. (2013). https://github. com/cloudius-systems/osv/issues/43, online, accessed 12/10/2018.
[51]
OSv Contributors 2014. Porting native applications to OSv: problems you may run into. (2014). https://github.com/cloudius-systems/osv/ wiki/Porting-native-applications-to-OSv . Online, accessed 05/02/2018.
[52]
OSv contributors. 2016. OSv Issues: Thread-local storage doesn’t work in PIE. (2016). https://github.com/cloudius-systems/osv/issues/352, Online, accessed 04/21/2018.
[53]
Yoann Padioleau, Julia Lawall, René Rydhof Hansen, and Gilles Muller. 2008. Documenting and Automating Collateral Evolutions in Linux Device Drivers. In Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008 (Eurosys ’08). ACM, New York, NY, USA, 247–260.
[54]
Russell Pavlicek. 2018. Containers 2.0: Why unikernels will rock the cloud. (2018). https://techbeacon.com/ containers-20-why-unikernels-will-rock-cloud . Online, accessed 08/05/2018.
[55]
Max Plauth, Lena Feinbube, and Andreas Polze. 2017. A Performance Survey of Lightweight Virtualization Techniques. In Proceedings of the 6th European Conference on Service-Oriented and Cloud Computing (ICN 2017). Springer, 34–48.
[56]
Donald E. Porter, Silas Boyd-Wickizer, Jon Howell, Reuben Olinsky, and Galen C. Hunt. 2011. Rethinking the Library OS from the Top Down. In Proceedings of the Sixteenth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS XVI). ACM, New York, NY, USA, 291–304.
[57]
Pthread Embedded 2017. Pthread Embedded Website. (2017). http: //pthreads-emb.sourceforge.net/, Online, accessed 12/12/2017.
[58]
Anh Quach, Rukayat Erinfolami, David Demicco, and Aravind Prakash. 2017. A Multi-OS Cross-Layer Study of Bloating in User Programs, Kernel and Managed Execution Environments. In Proceedings of the 2017 Workshop on Forming an Ecosystem Around Software Transformation (FEAST).
[59]
Ali Raza. 2018. UKL: A Unikernel Based on Linux. https://next.redhat. com/2018/11/14/ukl-a-unikernel-based-on-linux/, Online, accessed 12/12/2018. (2018).
[60]
Rump contributors. 2016. Rumpkernel FAQ. (2016). https://github. com/rumpkernel/wiki/wiki/Info:-FAQ, Online, accessed 04/21/2018.
[61]
Florian Schmidt. 2017. uniprof: A Unikernel Stack Profiler. In Proceedings of the ACM Special Interest Group on Data Communication Conference (Posters and Demos) (SIGCOMM’17). ACM, 31–33.
[62]
Sangmin Seo, Gangwon Jo, and Jaejin Lee. 2011. Performance characterization of the NAS Parallel Benchmarks in OpenCL. In IEEE International Symposium on Workload Characterization (IISWC 2011). IEEE, 137–148.
[63]
Giuseppe Siracusano, Roberto Bifulco, Simon Kuenzer, Stefano Salsano, Nicola Blefari Melazzi, and Felipe Huici. 2016. On the Fly TCP Acceleration with Miniproxy. In Proceedings of the 2016 Workshop on Hot topics in Middleboxes and Network Function Virtualization (HotMiddlebox 2016). ACM, 44–49.
[64]
Solo 5 2017. The Solo5 Unikernel. (2017). https://github.com/Solo5/ solo5 . Online, accessed 11/25/2017.
[65]
Richard Stallman, Roland Pesch, Stan Shebs, and others. 1988. Debugging with GDB. Free Software Foundation 675 (1988).
[66]
Victor Stinner. 2017. The Python Performance Benchmark Suite. (2017). http://pyperformance.readthedocs.io/, Online, accessed 08/04/2018.
[67]
Josh Triplett. 2015. Using the KVM API. (2015). https://lwn.net/ Articles/658511/ . Online, accessed 11/25/2017.
[68]
Chia-Che Tsai, Kumar Saurabh Arora, Nehal Bandi, Bhushan Jain, William Jannen, Jitin John, Harry A Kalodner, Vrushali Kulkarni, Daniela Oliveira, and Donald E Porter. 2014. Cooperation and security isolation of library OSes for multi-process applications. In Proceedings of the Ninth European Conference on Computer Systems (EuroSys’14). ACM, 9.
[69]
Chia-Che Tsai, Bhushan Jain, Nafees Ahmed Abdul, and Donald E Porter. 2016. A study of modern Linux API usage and compatibility: what to support when you’re supporting. In Proceedings of the Eleventh European Conference on Computer Systems. ACM, 16.
[70]
Chia-Che Tsai, Donald E Porter, and Mona Vij. 2017. Graphene-SGX: A practical library OS for unmodified applications on SGX. In Proceedings of the USENIX Annual Technical Conference (ATC 2017). 8.
[71]
Unikraft 2017. Xen Website - Unikraft. (2017). https://www. xenproject.org/help/wiki/80-developers/207-unicore.html . Online, accessed 11/27/2017.
[72]
Ruoyu Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry, John Grosen, Paul Grosen, Christopher Kruegel, and Giovanni Vigna. 2017. Ramblr: Making Reassembly Great Again. (2017).
[73]
Shuai Wang, Pei Wang, and Dinghao Wu. 2015. Reassembleable Disassembling. In USENIX Security Symposium. 627–642.
[74]
Adam Wick. 2012,. The HaLVM: A Simple Platform for Simple Platforms. Xen Summit. (2012,).
[75]
Chadd C Williams and Jeffrey K Hollingsworth. 2004. Interactive binary instrumentation. In Second International Workshop on Remote Analysis and Measurement of Software Systems (RAMSS).
[76]
D. Williams and R. Koller. 2016. Unikernel Monitors: Extending Minimalism Outside of the Box. In 8th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 16). USENIX Association, Denver, CO, USA. https://www.usenix.org/conference/hotcloud16/ workshop-program/presentation/williams
[77]
Dan Williams, Ricardo Koller, Martin Lucina, and Nikhil Prakash. 2018. Unikernels As Processes. In Proceedings of the ACM Symposium on Cloud Computing (SoCC ’18). ACM, New York, NY, USA, 199–211.
[78]
Bruno Xavier, Tiago Ferreto, and Luis Jersak. 2016. Time provisioning Evaluation of KVM, Docker and Unikernels in a Cloud Platform. In Proceedings of the 16th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGRID 2016). IEEE, 277–280.
[79]
Xen Website. 2018. Google Summer of Code Project, TinyVMI: Porting LibVMI to Mini-OS. (2018). https://blog.xenproject.org/2018/09/05/ tinyvmi-porting-libvmi-to-mini-os-on-xen-project-hypervisor/, Online, accessed 10/30/2018.
[80]
Yiming Zhang, Jon Crowcroft, Dongsheng Li, Chengfen Zhang, Huiba Li, Yaozheng Wang, Kai Yu, Yongqiang Xiong, and Guihai Chen. 2018. KylinX: A Dynamic Library Operating System for Simplified and Efficient Cloud Virtualization. In Proceedings of the 2018 USENIX Annual Technical Conference.
[81]
ChongChong Zhao, Daniyaer Saifuding, Hongliang Tian, Yong Zhang, and ChunXiao Xing. 2016. On the performance of intel sgx. In Web Information Systems and Applications Conference, 2016 13th. IEEE, 184– 187.

Cited By

View all

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
VEE 2019: Proceedings of the 15th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments
April 2019
206 pages
ISBN:9781450360203
DOI:10.1145/3313808
  • General Chair:
  • Jennifer Sartor,
  • Program Chairs:
  • Mayur Naik,
  • Chris Rossbach
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 April 2019

Permissions

Request permissions for this article.

Check for updates

Badges

  • Best Paper

Author Tags

  1. Binary Compatibility. Virtualization
  2. Linux Kernel
  3. Operating Systems
  4. Unikernels

Qualifiers

  • Research-article

Funding Sources

Conference

VEE '19

Acceptance Rates

Overall Acceptance Rate 80 of 235 submissions, 34%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)402
  • Downloads (Last 6 weeks)57
Reflects downloads up to 13 Jan 2025

Other Metrics

Citations

Cited By

View all

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media