The launch of the new version of the MirageOS 3.6 project was announced a few days ago . This is an operating system library that allows the formation of single-application operating systems as a "unikernel," which is autonomous and capable of running without the use of other operating systems—an independent operating system kernel.
OCaml is used for application development. The project code is distributed under a free ISC license. The basic idea behind a unikernel is that it is a highly optimized, purpose-built operating system that can help enable efficient operation and application delivery.
All the low-level functionality inherent in the operating system is implemented in the form of a library attached to the application.
The application can be developed on any operating system, after which it is compiled into a specialized kernel (unikernel concept), which can be run directly on Xen, KVM, BHyve and VMM (OpenBSD) hypervisors , on mobile platforms, as a process in a POSIX-compliant environment or in Amazon Elastic Compute Cloud and Google Compute Engine cloud environments.
The generated environment contains nothing superfluous and interacts directly with the hypervisor without controllers and system layers, achieving a significant reduction in overall costs and increased security.
Working with MirageOS is reduced to three stages: preparing the configuration with the definition of the OPAM packages used in the environment, building the environment, and starting the environment.
The runtime for working on Xen is based on the Mini-OS thin kernel, and for other hypervisors and systems based on the Solo5 kernel.
What's new in MirageOS 3.6?
The main changes in the new version are related to providing support for the new features proposed in Solo5 0.6.0. This project originally began as a way to port MirageOS to run on the Linux/KVM hypervisor. Since then, it has evolved into a more general-purpose sandboxed runtime environment , suitable for running applications built using various unikernels, targeting different sandboxing technologies on various host operating systems and hypervisors.
Among the improvements implemented, the support for the manifest stands out, which allows defining several network adapters and storage devices connected to a unikernel during isolation based on hvt, spt and muen backends (the use of genode and virtio backends is limited to one device so far)-
As well as support to enable stack smashing protection across the entire toolchain by default and enhanced page protection on some targets.
Another highlight of the announcement is the ability to run the MirageOS unikernel in the isolated spt environment provided by Solo5. When using the spt backend, MirageOS kernels run in Linux user processes with minimal isolation based on seccomp-BPF.
Solo5 (hvt, spt) -based backend protection is strengthened, for example compilation in SSP (Stack Crush Protection) mode is provided.
How to get MirageOS?
For those interested in being able to obtain this new version of MirageOS, they can do so by following the instructions that we share below.
The requirements to install MirageOS are a UNIX system (Linux, Mac or BSD) and OPAM 2.0.0 or later and OCaml 4.05.0 or later.
In the event that this is not the case, they can be installed by executing one of the following commands in the terminal depending on your distribution.
For those who are users of Debian, Ubuntu or derivatives of these:
sudo apt-get update
sudo apt-get install opam
For those using Arch Linux, Manjaro, or any other Arch derivative:
sudo pacman -S opam
Fedora, RHEL, CentOS or any other derivative of these:
sudo dnf -i opam
Finally, to install MirageOS:
opam init
opam install mirage