16:08 <blurider> Is this the IRC for mirage OS?

16:09 <Drup> yes

16:09 <blurider> I just read a unikernel article and I'm not sure what the point of a unikernel is. It seems to be a very simplified VM, but why not just run the OCAML application on bare metal?

16:11 <jerith> blurider: To do anything useful, you need device drivers, maybe a network stack, etc.

16:11 <jerith> That's basically what the unikernel gives you.

16:12 <jerith> Think of it as a set of libraries that do what the OS would normally do.

16:13 <blurider> jerith: So it's just providing a unified driver set (from the Xen kernel in this case)? I'm just wondering how that's different from the PLT Racket VM?

16:19 <hannes> blurider: PLT racket requires a unix underneath (at least the last time I checked), or can it run directly as a virtual machine on top of Xen?

16:19 <hannes> blurider: there's also initial support to use rumpkernel in MirageOS instead of xen, this will allow to use netbsd drivers and running on bare metal without a hypervisor

17:35 <blurider> hannes: it requires either a Unix, Mac OS, or Windows

17:35 <blurider> hannes: I was just wondering what the advantage of a unikernel compared to a bare metal application.

17:36 <blurider> hannes: I mean, why can't one target the JAVA VM or the Racket VM instead of Mirage?

17:40 <blurider> I'm not trying to be a troll here, I'm just wondering what's the advantage of mirage compared to running a more securely chrooted application (say via systemd-nspawn)?

17:42 <jerith> blurider: What do you mean by "bare metal"?

17:43 <blurider> jerith: say running a simple application written in C and Glib that runs on the Linux kernel

17:43 <blurider> jerith: Or, say writing it in haskell.

17:43 <jerith> Also, you may be confusing VM-meaning-application-runtime and VM-meaning-virtual-hardware.

17:44 <blurider> jerith: Possibly. In the case of PLT Racket, the network stack is provided by PLT Racket, the JIT is written in GNU Lightning so it emulates a RISC instruction set.

17:45 <jerith> Let's say you have hosting infrastructure that lets you spin up xen VMs.

17:46 <jerith> In order to run your C app on that, you need an operating system, a filesystem, maybe some network services of some kind, etc.

17:46 <jerith> In order to run your Mirage app on that, you need the single unikernel binary and nothing else.

17:50 <blurider> jerith: So mirage is useful on particular infrastructure. As in, if the hosting only allows rumpkernel or xen? The cloud provider doesn't allow running programs on bare metal?

17:52 <jerith> blurider: "bare metal" usually means "no operating system".

17:52 <jerith> Hence the confusion above.

17:54 <jerith> The point of Mirage is that your applications are entirely self-contained.

18:03 <z0d> blurider: with Mirage, you don't have to install an OS on top of Xen. that's the point

18:04 <blurider> z0d: All right.

18:07 <z0d> it's has some similarities to Docker/LXC if you know them

18:07 <z0d> but Mirage takes a different approach

18:08 <blurider> z0d: Yeah, that's what i was wondering.

18:09 <z0d> so, I guess you can run not only Linux applications on Mirage

18:09 <z0d> (?)

18:10 <z0d> with Docker, you can only run apps which are Linux based

18:11 <blurider> z0d: It just seems like GNU lightning to me, but based on Xen.

18:14 <blurider> z0d: And, with device driver (xen) support.

18:15 <jerith> blurider: It's nothing like GNU lightning.

18:15 <jerith> Think of it as a lightweight kernel with your application built-in.

18:16 <blurider> jerith: There are comparisons to lightning and VMs, but i won't go into that.

18:16 <blurider> jerith: All right. is there a measurable performance difference when running a unikernel vs. straight on the linux host?

18:19 <jerith> blurider: Have you read https://mirage.io/wiki/overview-of-mirage ?

18:22 <jerith> Also, https://mirage.io/wiki/technical-background may answer some of your questions.

18:28 <blurider> jerith: Yeah, I read it. I'll need to organize my thoughts a bit. It seems to be dependent on folks using XEN now to boot full kernels instead of the old time sharing method with multiple users. With cgroups in Linux (used in containers), and systemd-nspawn, it should be possible to run contained programs (even written in OCAML) with similar security.

18:33 <blurider> jerith: Seems somewhat convenient though (at least it's glued together). I'll be watching the project with interest.