Docker Container compared with Unikernel
Asked Answered
E

3

24

I recently deployed a tiny Haskell app with docker, using "scratch-haskell" as a base image.

Then I read about Unikernels and HALVM. And I got a little confused.

My docker container is about 6MB large. A Unikernel (with the same haskell app) would be roughly the same size I guess.

The Unikernel runs directly on the Xen hypervisor, whereas the docker Image (or general LXC) runs on a normal Linux distribution, which runs on bare metal.

Now I have the "choice" of running Linux with multiple minimal containers OR a Xen machine with multiple small Unikernels.

But what are the advantages and disadvantages of those two solutions? Is one more secure than the other? And are there any significant performance differences between them?

Exportation answered 22/5, 2015 at 8:48 Comment(1)
unikernel being quite recent, I guess you should run your own testsPlate
P
14

from http://wiki.xenproject.org/wiki/Unikernels

What do Unikernels Provide?

Unikernels normally generate a singular runtime environment meant to enable single applications built solely with that environment. Generally, this environment lacks the ability to spawn subprocesses, execute shell commands, create multiple threads, or fork processes. Instead, they provide a pure incarnation of the language runtime targetted, be it OCaml, Haskell, Java, Erlang, or some other environment.

Unikernels Versus Linux Containers

Much has been made recently of the advantages of Linux Container solutions over traditional VMs. It is said by container advocates that their lightweight memory footprint, quick boot time, and ease of packaging makes containers the future of virtualization. While these aspects of containers are certainly notable, they do not spell the end of the world of the hypervisor. In fact, Unikernels may reduce the long-term usefulness of containers.

Unikernels facilitate the very same desirable attributes described by the container proponents, with the addition of an absolutely splendid security story which few other solutions can match.

So if you want just run Haskell application Unikernels may work for you, and they should have even less overhead than docker (and docker overhead is very small anyway), but if your application will need some prepared environment, need to communicate with non Unikernels software docker is a better choice. I guess it is too early to say will Unikernels be useful or widespread or not, only time will tell.

Portwin answered 22/5, 2015 at 10:37 Comment(3)
although, aren't unikernels becoming more powerful as time goes by? in terms of acquiring threading/forking and having access to storage etc. I see potential for some convergence...Catherinacatherine
Threading and forking are antithetical to the definition of unikernel.Flash
@Flash threading, as separate from forking is actually important for unikernels: "threading" means running multiple threads of execution for the same application, and is necessary to make use of multi-core VMs. "forking" (in Unix jargon) means multiple processes isolated from each other - that is what unikernels usually don't support.Mandorla
H
3

Unikernals are great for things that are stateless. When you start needing disk access you are better off using Docker.

That's why all the "killer" apps for unikernals are statically configured kernels, like static web pages or software defined networking stacks.

Hydrofoil answered 18/11, 2015 at 16:52 Comment(2)
I'm pretty sure unikernels can be made stateful if needed. Maybe not by exposing some sort of disk I/O, but there are other means for persistence.Catherinacatherine
Fast forward to 2020, we can now safely say that unikernels can definitely support stateful applications with persistent storage. An example of a unikernel with persistent storage support is Nanos (github.com/nanovms/nanos).Telpherage
R
3

There are many good explations heres a simple one :

Unikernel are VMs but specialized and optimized for the particular application.

enter image description here

Refine answered 23/1, 2016 at 23:30 Comment(2)
Here we miss docker running on bare metal without hypervisor / no VMsSeguidilla
Nicely illustrated, but please list references.Sistrunk

© 2022 - 2024 — McMap. All rights reserved.