After one and a half years of development, the release of the MirageOS 4.0 project has been published, which allows the creation of single-application operating systems where the application is provided as a self-sufficient 'unikernel' capable of running without an operating system, a separate OS kernel, or any layers. The OCaml language is used for application development. The project's code is distributed under the ISC open license.
All low-level functionality characteristic of an operating system is implemented in the form of a library attached to the application. The application can be developed in any operating system and then compiled into a specialized kernel (the unikernel concept) that can run directly on hypervisors like Xen, KVM, BHyve, and VMM (OpenBSD), on mobile platforms, as a process in a POSIX-compliant environment, or in cloud environments such as Amazon Elastic Compute Cloud and Google Compute Engine.
The generated environment contains nothing unnecessary and interacts directly with the hypervisor without drivers and system layers, which allows for a significant reduction in overhead and increased security. Working with MirageOS involves three stages: preparing the configuration by defining the OPAM packages used in the environment, building the environment, and running the environment. The runtime to ensure operation over hypervisors is built on the Solo5 kernel.
Although applications and libraries are formed in the high-level OCaml language, the resulting environments demonstrate quite good performance and minimal size (for example, a DNS server occupies just 200 KB). Maintaining environments is also simplified since, when a program needs to be updated or the configuration changed, it's sufficient to create and launch a new environment. Several hundred libraries in the OCaml language are supported for performing network operations (DNS, SSH, OpenFlow, HTTP, XMPP, Matrix, OpenVPN, etc.), working with storage, and ensuring parallel data processing.
Key Improvements:
- The project compilation process and unikernel have been changed. Instead of the previously used build system ocamlbuild, the dune toolchain and local repositories (monorepo) are now employed. A new utility called opam-monorepo has been added for creating such repositories, allowing for the separation of package management from building from source code. The opam-monorepo utility handles tasks such as creating lock files for project-related dependencies, fetching and extracting dependency code, and setting up the environment for the dune build system. The actual build is carried out using the dune toolchain.
- A reproducible build process has been provided. The use of lock files ensures binding to dependency versions and allows for the complete reproduction of the build process with the same code at any time.
- A new cross-compilation process has been implemented, providing the capability to cross-compile for all supported target platforms from a single common build environment, which also performs cross-compilation for dependencies and libraries with C bindings, without needing to add those bindings to the main package. Cross-compilation is organized using workspaces provided by the dune build system.
- Support for new target platforms has been added, including an experimental capability to build standalone applications for Raspberry Pi 4 boards.
- Efforts have been made to integrate parts of MirageOS into ecosystems related to OCaml development to simplify the building of applications in the form of unikernel. Many MirageOS packages have been ported to the dune build system. The opam-monorepo utility is available for installation through the opam package manager and can be used in projects using the dune build system. To manage patches that resolve dependency build issues in dune, two repositories, dune-universe/opam-overlays and dune-universe/mirage-opam-overlays, have been created and are included by default when using the CLI utility mirage.
- The integration of MirageOS with C and Rust libraries has been simplified.
- A new OCaml runtime has been proposed that eliminates the need for libc (libc-free).
- The option to use the Merlin service for integration with type integrated development environments has been provided.
Source: opennet.ru
