Release of MirageOS 3.6, a platform for running applications over hypervisors

Took place project release MirageOS 3.6, enabling the creation of single-application operating systems where the application is delivered as a self-contained "unikernel" that can run without the use of operating systems, a separate OS kernel, or any intermediaries. The applications are developed using the OCaml language. The project code is distributed is under the free ISC license.

All low-level functionality inherent to the operating system is implemented in the form of a library that is attached to the application. The application can be developed in any OS and is then compiled into a specialized kernel (the concept of unikernel), which can run directly over hypervisors such as Xen, KVM, BHyve, and VMM (OpenBSD), on mobile platforms, as a process in a POSIX-compatible environment, or in cloud environments like Amazon Elastic Compute Cloud and Google Compute Engine.

The generated environment contains nothing extraneous and interacts directly with the hypervisor without drivers and system layers, allowing significant overhead reduction and increased security. Working with MirageOS consists of three stages: preparing the configuration by defining the OPAM packages , building the environment, and running the environment. The runtime for operation over Xen is based on a trimmed-down kernelMini-OS , while for other hypervisors and kernel-based systems, it's based onSolo5. Although applications and libraries are built using the high-level OCaml language, the final environments demonstrate quite good performance and minimal size (for example, a DNS server occupies only 200 KB). Maintaining the environments is also simplified because when updating a program or changing a configuration, it is sufficient to create and launch a new environment. It supports.

dozens of libraries in OCaml for performing network operations (DNS, SSH, OpenFlow, HTTP, XMPP, etc.), working with storage, and ensuring parallel data processing. The main changes in the new release are related to providing support for new features proposed in the

Solo5 0.6.0 (sandbox environment for executing unikernel): The ability to launch MirageOS unikernel in an isolated environment has been added

• spt ("sandboxed process tender"), provided by the toolkit. ("sandboxed process tender"), provided by the toolkit Although applications and libraries are built using the high-level OCaml language, the final environments demonstrate quite good performance and minimal size (for example, a DNS server occupies only 200 KB). Maintaining the environments is also simplified because when updating a program or changing a configuration, it is sufficient to create and launch a new environment. It supportsWhen using the spt backend, MirageOS kernels are run in user processes of Linux, which apply minimal isolation based on seccomp-BPF;
• Support has been implemented application manifests from the Solo5 project, allowing multiple network adapters and storage devices to be attached to unikernels while isolating based on hvt, spt, and muen backends (use with genode and virtio backends is currently limited to one device);
• Enhanced protection for Solo5-based backends (hvt, spt), for example, includes compilation in SSP (Stack Smashing Protection) mode.

Source: opennet.ru