Justin Cormack, who worked on Mirage OS and Unikernel Systems, noticed a resurgence in unikernel interest and interviewed the author for his newsletter. Their conversation, held over beer at a pub, covered Mirage, Orleans, Haskell, Nix, and Cursed. A unikernel merges application and OS, eliminating userland—so services like web servers or DNS must be built as libraries.
This was historically difficult due to missing drivers and storage support, requiring pulling components from NetBSD. The author calls traditional OS design 'design debt' rooted in 40-year-old multi-user assumptions for human operators. This legacy creates attack surfaces: popping a userland app gives attackers a shell and 'VIP butler' for exfiltration.
Unikernels reduce this by removing shells and interpreters—without them, model weights (like AI) have no next action, turning easy RCE exploits into targeted attacks needing source code. While library gaps (e.g., Stripe in OCaml) once deterred adoption, AI now enables porting missing libraries via automation. The shift isn’t just technical—it’s cognitive: overcoming the dogma that unikernels are 'hard' by leveraging AI to handle complexity.
Source: Hacker News · Summarized by HeadlinesBriefing