Over the last several years, other computer science researchers and I have talked about the promise of unikernels -- single-purpose, lightweight virtual machines -- in the cloud. However, all of these talks simply presented our architectures and speculated about their usefulness. Over the last several years, Galois has actually been using unikernels to implement interesting components in critical systems: non-bypassable encryption components, network monitors and alarms, platform obfuscation capabilities, Tor nodes, network re-routers, and so on.

In this talk, I will speak about the lessons we’ve learned during this work, and try to draw conclusions about when unikernels are appropriate solutions and when they are not.