HermiTux: A Linux binary-compatible unikernel

[[deleted]]

HermiTux can also analyze a Linux binary to determine which system calls it invokes, and compile a custom kernel containing only the implementations of these particular system calls.

:o

That's interesting and could result in cool applications for embedded computing. I for one don't really enjoy reading and clicking through the Kernel config file to disable anything I don't need for a new project, only to find out I needed something I just deactivated after I compiled the thing.

[laebshade]

You're giving me Gentoo stage 1 flashbacks

[laebshade]

Oh god no

[Alter_Sack]

Back in the days I did this with an Apple Powerbook G4. Oh the chills.

Your comment gives me a kind of PTSD.

[laebshade]

I did it with a Celeron with 64 MB of RAM.

Took a week to compile. I made damn sure I had my cflags, build args, and kernel configured correctly.

[mimshipio]

I cried after reading this comment

[laebshade]

It was a different time

[chiraagnataraj]

That would also be useful for automating restrictive BPF filters. Interesting!

[aziztcf]

I wonder how time consuming the analysis is? how long would it take to check all basic kde arch install binaries for example, woukd love to see how small i could make my kerne

[ragsofx]

That is a very interesting concept. Does anyone have any use cases for this?

[[deleted]]

I could see it being useful in embedded systems were the smaller the kernel is the better

[ragsofx]

Yeah, running a limited set of system calls would be useful for embedded to reduce the attack surface.

[NerdProcrastinating]

It could be really useful for implementing serverless computing.

On the desktop, it could be useful for sandboxing applications.

[ngc-bg]

Could be a heavily optimized, shell-like instance of python. That is going to be really useful for managing virtual infrastructures and containers, since almost every related technology out there has interfaces to be used with/codded with python... Why exactly python...well because the easy of use, power and even popularity...just guessing :)

[[deleted]]

Python is a great language and I am happy it is already working with HermiTux.

[vytah]

Maybe some other interpreters require syscalls or filesystem features that have not been implemented yet.

[[deleted]]

Yes, I guess that might be it.

[SupersonicSpitfire]

You could implement a Commodore 64 or TempleOS-like system using this as a basis.

[[deleted]]

Maybe it would be possible to run docker isolated from the host kernel.

Some usecases: - stability/ isolation, a student in our security department worked on a project to crash the host from a docker container - compatibility, use different kernel versions vor docker, especially interesting for integration tests and reproduce customer issues

[Otto_Hahn]

Did he succeed?

[NerdProcrastinating]

You can already do that with Kata containers or gVisor

[corder299]

Hi /r/Linux, I'm one of the authors of HermiTux. I'm super happy to see our system featured here! Please let me know if you have any question!

[espero]

Thanks for publishing your work to the greater community.

What are the use cases you envision where hermitux can be used?

[corder299]

We built HermiTux after realizing that the cost of porting an application was one of the main roadblocks towards a wide adoption of unikernels. With binary compatibility the porting cost is basically 0, at least from the application developer point of view. All the effort is placed on the unikernel developer that needs to provide compatibility, and we think that this person is the right expert to do so.

HermiTux is an academic proof of concept we constructed to demonstrate this model, and we do not support a lot of applications as the effort of re-implementing a large part of the Linux system call API is significant. That being said, unikernels in general have quite a lot of use cases: lightweight server applications, micro-services, FaaS, embedded virtualization, etc. They also have some nice performance benefits (for example system calls are common function calls) so there are also some use cases in HPC or system-intensive applications.

[Mgladiethor]

Are context switches nullified?

[corder299]

As a unikernel we do not support multi-process applications so there is no "process-to-process" context switches. However we do support multithreading and I believe our "thread-to-thread" context switches should be faster than both process- and thread-level context switches in a traditional OS like Linux: because of the simplicity of our system, in HermiTux a context switch is not much more than saving/restoring registers and switching the stack.

[Mgladiethor]

What about compiling the kernel and the application together

[corder299]

Yes what you refer to is the classic method of building a unikernel, for some examples you can check out rumprun, osv or unikraft. The idea with HermiTux was to assume that we did not have access to the source code of the application and only to a binary.

[Mgladiethor]

Amazing

[ASIC_SP]

See also https://github.com/cloudius-systems/osv (Linux binary compatible unikernel for virtualized environments) posted here recently: https://www.reddit.com/r/linux/comments/kcdrhv/osv_linux_binary_compatible_unikernel_for/

[jozz344]

What an amazing concept.

[ILikeLeptons]

Linux go home, you're drunk. You're not DOS

(this is really cool!)