Unikernel Tutorials

Measuring Unikernel Cold Boot Time with Perf

A while back ago CDNs would market on their TTFB - that is the 'time to first byte'. It sounds like a really important number and the lower you can make it the more impressive it looks. At the end of the day though it doesn't really matter cause a single image can be tens of kilobytes or even megabytes in size. A single page can have 80 some odd requests and transfer multiple megabytes in resources. So while it is interesting it's a bit of a vanity metric.

Bringing MultiQueue to the Nanos Unikernel Network Stack

We've made substantial changes to our networking stack. Some of those include numerous changes to our LWIP fork (which not even sure we can call it LWIP anymore as it's totally different). This latest change allows multiple transmit and receive (tx/rx) queues. In short this allows superior network performance when you have an instance with multiple vcpus.

Introducing Memfd Create and Anonymous Files for the Nanos Unikernel

We recently introduced support for the memfd_create syscall which allows one to create anonyous files. Anonymous files are different from something like a temporary file in that it lives in ram vs being stored on disk.

Enabling KASLR for the Nanos Unikernel

We recently enabled KASLR on by default. We currently don't even have a way of turning it off via manifest since it is turned on before we even detect the disk from which the manifest option might be located -- in other words you have to disable it via a custom build.

Confidential Computing with AMD SEV Enabled Unikernels

We brought AMD SEV into the Nanos unikernel. SEV (secure encrypted virtualization) is an extension of the existing AMD SME (secure memory encryption) extension. Essentially, memory pages (including code and data) are encrypted outside the purview of the hypervisor using dedicated hardware. This hardware encrypts data as it is written to DRAM and decrypted upon read.

User Mode Concurrency Groups - Faster than Futexes

We took google's UMCG (user mode concurrency groups) implementation (which is a part of google fibers - no not the isp) and added it as an optional klib to nanos. This allows you to make your own user-space schedulers. This opens a whole new world of ultra highly scalable software. I can see a lot of applications for this including high performance databases and making various language runtimes a lot smarter. We also think this fits in very well with the Nanos architecture.

Dumping Null Terminated Strings

We recently made a very large change in Nanos. We jettisoned all of the null terminated strings that we could. While it's something that's been on our long list of known issues we wanted to address we finally bit the bullet and started the transition.

Segmentation Offload Comes to the Nanos Unikernel

Everyone seems to think you can wave a few magic wands and instantly get superior performance -- unfortunately reality is not that cut and dry. Performance engineering requires extensive engineering, measuring and re-engineering to achieve results. Don't listen to charalatans that tell you otherwise.

Dynamic Reconfiguration of Unikernels at Boot Time with Firecracker

One of the first things that stands out to people when they first start playing around with unikernels is that the concept of an interactive server that you can pop into and start running all sorts of arbitrary programs (also known as 'commands') is supplanted by just one program - yours.

Microsecond Precision with the PTP and Hardware Clocks for Unikernels

In Nov 2023 Amazon announced micro-second precision with their PTP clock. Within two weeks we had the first bit of support out the door. But we're getting ahead ourselves. PTP? PHC? Is this some kind of a new drug? What happened to NTP?

Refactoring Nginx Worker Processes to be Multi-Threaded

We've supported nginx running as a unikernel as-is w/no patches for a long time but it still uses 90s style worker processes, so naturally we cut patches to convert them to threads and instantly got a free performance boost.

What is VSOCK and Why Use it with Unikernels?

VSOCK refers to the AF_VSOCK address family. You might be more familiar with the AF_INET socket family. At it's core, it enables a way to communicate talking from a guest vm to the host or vice-versa. You can utilize both SOCK_STREAM (connection based) and SOCK_DGRAM (connection-less).

Running Postgres as a Unikernel

This isn't the first time we took a look at running postgres as a unikernel. A few years ago one of our engineers took a look at how difficult it might be to port it. He made a lot of progress but after spending a handful of days getting rid of shared memory and converting the processes to threads decided to punt it down the road until someone really wanted it.

Applying Sandbox Security to Node.JS Unikernels with OpenBSD Pledge and Unveil

We recently added support for both OpenBSD's pledge and unveil syscalls. The first one can apply security policies for disallowing certain syscalls while the latter one can apply a restricted filesystem view. In this tutorial we'll show you how you can easily apply a sandbox to your prod workloads effortlessly.

Dropping Packets from Unikernels

For quite some time now ops has auto-generated firewall rules for various cloud providers such as GCP and AWS. In this tutorial we learn how to implement a network firewall in the Nanos unikernel through simple configuration.

Accessing the host filesystem from a Nanos guest using 9P

With the addition of VirtFS support to the Nanos kernel, it is now possible to access files and folders on your local development machine from your on-premises Nanos instance. This allows creating/deleting/modifying files in your computer and having these changes synchronized to a running Nanos instance without re-creating an image or rebooting the instance.

Introducing Console Drivers to Stream to GCP Logging and AWS CloudWatch

There are about a billion ways to get logs out of your nanos instance. By default when ran locally via 'ops run' or 'ops pkg load' stdout/stderr go straight out through the serial port and that is fine for most use-cases *locally*.

GPU-accelerated Computing with Nanos Unikernels

Machine learning frameworks such as TensorFlow and heterogeneous computing libraries such as OpenCL can use GPUs as computing devices in addition or as an alternative to CPU cores. With a new klib implementing a GPU driver, you can run a Nanos unikernel in a VM instance equipped with a GPU and execute your compute-intensive workloads on the GPU.

Cross Region Unikernels at the Edge

It seems that all the cool companies are doing cross-region geo-routing for applications today. Many of them will label this as "edge". For someone like myself edge usually means something different like having actual devices at sea, in the air, on a cell tower, in a Tesla, etc but if you are coming from the CDN world that translates to having multiple POPs (point of presence) spread throughout the world where you can host typically static sites (like javascript, css, etc.) closer to the end-user.

Virtio-RNG Inside Nanos

In the Nanos kernel, we have recently added support for the virtio-rng device. This virtio device allows applications to use it as a source of randomness without relying on dedicated processor instructions that may not be available in all clouds or hypervisors.

Sending memory metrics to Amazon CloudWatch

Thanks to a new kernel library, Nanos can now communicate with Amazon CloudWatch, the monitoring service for AWS applications and resources. This article explains how to set up a Nanos unikernel application so that its memory utilization metrics can be monitored via Amazon CloudWatch.

Closures in the Nanos Unikernel

This article does an overview on the use of closures in the Nanos kernel. Closures are common in languages like Ruby and Swift. The C language does not include them, thus, the Nanos kernel relies on its own implementation. We use closures not only to implement callbacks with saved variables but also to compose continuations for asynchronous operations. In this article, we present what a closure is and we show the dedicated API that the Nanos kernel provides to manipulate closures.

The Tuple Filesystem in the Nanos Unikernel

General Purpose Operating Systems use a filesystem (fs) to store data in a persistent way like on a hard disk. Generally speaking, data is stored in files which belong to a directory. Thus most filesystems are organized in a hierarchical way. The fs stores files in blocks into physical devices.

Running Nanos on AWS Graviton

With Nanos now able to run on AWS Graviton instances, we have the option of deploying a Nanos unikernel on public cloud VMs with processors other than Intel or AMD. This article shows how to run Nanos on a Graviton2 (64-bit ARM) instance, and explains some technical details involved in running an operating system on an ARM-based server platform.

Nanos on 64-bit RISC-V

Nanos can now be built for the riscv64 (64-bit RISC-V) architecture. We discuss how to cross-compile and run Nanos and RISC-V programs with QEMU, and also go over some of the technical aspects of porting Nanos to RISC-V.

Red-Black Trees in NanoVMs

Red-black trees (rbtrees) are data-structures widely used in the kernel. For example, this data-structure is one of the building blocks of the Linux scheduler. In this article, we overview general concepts about trees and then we focus on what makes rbtrees very interesting.

Bitmaps in NanoVMs

This article is an overview of bitmaps, which is a data-structure heavily used in the kernel. NanoVMs provides a dedicated API to handle bitmaps. In the following, we present the API to instantiate bitmaps and how this API is adapted to deal with different use-cases. Also, we present the kernel’s data-structures that are represented by using bitmaps.

Overview of EBPF in the era of Unikernels

This article overviews EBPF (Extended Berkeley Packet Filter), which is a recent technology available in the Linux kernel to add user-defined functionalities in the kernel. This article aims at understanding what EBPF is and its use-cases.

Running Unikernels on the Bhyve Hypervisor on FreeBSD

In this tutorial we show you have to run a Nanos unikernel on the Bhyve hypervisor on top of FreeBSD.

Creating a VPN Gateway with a Unikernel running WireGuard

The security advantages of unikernels make them a great fit for a public-facing dedicated network appliance such as a VPN gateway. With some special configuration, we can run a userspace WireGuard implementation on Nanos to make a gateway to a cloud private network.

Using NetConsole for Debug Logging of Unikernels

Nanos has many different logging options. You can log to serial, you can log to files, you can ship things over syslog. We even made a syslog klib so you don't have to modify your code. Today we'll show you yet another way to log.

Debugging Unikernels Using New Native TFS Tools

OPS recently gained native TFS dump support. TFS is the default filesystem for the Nanos unikernel. The new support allows you to run simple commands such as ls, cp, and tree directly on a Nanos image. You don't need FUSE and you can run this on a Mac too.

Profiling Unikernel Syscall Execution Time

It is no secret we like performance. Hell, we wrote our own kernel for that very reason. We've also made a lot of tooling in the past to help us find hotspots and make it easier to profile Nanos. Today we'll introduce you to another tool.

Autoscaling Unikernels with Instance Groups

Autoscaling has also been a common feature request from many users coming from a kubernetes environment. The cool thing about unikernels is that all of kubernetes complexity gets abstracted away since Nanos unikernels are deployed as virtual machines and the underlying cloud network and volume primitives are utilized versus duplicated with frameworks such as k8s.

CrossBuilding Unikernels on Mac without Docker or Vagrant

Some applications are hard to cross-compile on Mac if you are deploying to Linux servers. If you are using unikernels you might be relying on docker or vagrant to do this, however that is not necessary anymore with the new cross-compilation support for OPS.

Converting Docker Containers to Nanos Unikernels

Many Nanos/OPS users come from a docker background and there is a hidden implication that they might be working on a Mac for dev purposes. This can pose a problem for those that want to create their own software on a mac to run as a Nanos unikernel as Nanos consumes ELF binaries just like Linux does.

Nanos on 64-bit ARM Platforms

Nanos now targets platforms based on the aarch64 (64-bit ARM) architecture. In this tutorial, we'll learn how to build and run ARM unikernels, both on a Raspberry Pi 4 and as a cross-build from a non-ARM host. No ARM hardware required!

Embedding the Ruby and Python Interpreters into Nginx as a Unikernel

Ruby and Python are both popular interpreted languages. For many years developers that wished to deploy their Django, Rails and other applications written with these frameworks have routinely relied on front-end proxies such as Nginx and Haproxy and usually stuck those in front of a load balancer such as an ELB.

The Nanos Unikernel Now Has a FUSE Driver for TFS

One of our engineers just opened a PR for a FUSE driver for Nanos. What does this mean? It means you can now mount the filesystem natively on MacOS and Linux amongst other things.

Finding memory management errors in the Nanos Unikernel

Memory management errors are some of the most pernicious and most difficult bugs to troubleshoot. We can leverage the unique design of Nanos in order to create an small and efficient way of identifying these problems.

Running Mattermost as a Unikernel

Mattermost is an open source, private cloud slack alternative written in Go and React. It has many integrations and can can connect to mysql or postgres for persistence. While there are many "hello world" tutorials out there for running the Nanos unikernel we thought this would be a nice little example to showcase two things.

Understanding How to Use Klibs in the Nanos Unikernel

A while ago we wanted a pluggable method to instrument various stats in Nanos and we wanted to be able to apply this functionality to ad-hoc applications without having to re-write the code. So we took a page from the library operating system playbook and produced an inital draft for klibs in Nanos.

Working with Unikernel Volumes in Nanos

The most obvious time when you would want to attach a volume to your unikernel instance is when you are working with a database. Your database image probably doesn't change that much but many databases can grow very large and it makes no sense to keep the same data volume in your base image.

Debugging Nanos Unikernels with GDB and OPS

Some people think you can't debug unikernels. Tell that to the team of kernel engineers that routinely have to debug unikernels, sometimes without source code, sometimes without access to the system in question.

Profiling and Tracing the Nanos Unikernel

How does one go about profiling or tracing a unikernel? How do you login to the host and run perf or produce flame graphs? Isn't this impossible in a unikernel?

Autonomous Rust Unikernels in Google Cloud

Knowing the memory layout of an application and it's host operating system is vital to attacking a system. What if you could reboot an entire server in seconds and get a brand new memory layout each time? While not feasible with traditional linux vms and definitely not containers this is a uniquely cool unikernel feature.

Deploying Nanos Node.JS Unikernels to AWS

In this short tutorial we learn how to build, deploy, and run node.js unikenels to AWS using the t2 instance type.

Creation and Usage of Machine Learning Classification Models Using Unikernels

Learn to use machine learning classification with python3, sklearn and run them using unikernels.

InfluxDB Unikernels on Google Cloud

InfluxDB is a popular time series database that fits well inside an edge or IoT pipeline where you might be already using something like MQTT. If you're already using unikernels for your edge devices it might be a good idea to turn your time series datastore into one as well.

Unikernels from the Edge to the Cloud

MQTT is the quintessential protocol for edge and IoT devices to talk to the cloud for more than a few reasons. If you're a pumpjack in the middle of nowhere west texas 50 miles from town and you're in a field of said pumpjacks getting that data out can be a hassle.

Assessing Unikernel Security

A lot has been said about the security posture of unikernels. I know I've said a mouthful myself. ;) I originally wasn't going to write this article but I've now had to respond to the same question a number of times so my hand has been forced.

Running Forth Unikernels

Forth has been called lots of things and it was something that I figured we could easily unikernelize so I dove into it. I think it's safe to say I've never written any production Forth nor do I see myself doing so but having said that - let's begin!

Running WASM Unikernels

WASM is a new way of transpiling high level languages to a common binary format. Here we show how we can take WASM and run it as a unikernel.

Logging Go Unikernels to PaperTrail

Learn how to implement logging in your Go unikernels with a Free Account from PaperTrail.

Running Go Unikernels

After running my first c example in rumprun a few years ago the next language I wanted to try out was Go. Unfortunately there were no Go unikernels at the time so we sponsored one for rumprun. That was 3 years ago.

Running Node.JS Unikernels

Javascript developers were some of the earliest adopters of things like containers, serverless and other infrastructure patterns so it's not surprising that unikernels interest them too.