Tutorial: 11:45-13:15 (English)
MirageOS: building minimized special-purpose unikernels
How to develop secure and type-safe MirageOS unikernels
Unikernels are specialized services, where the runtime binary (process, virtual machine) only contains the necessary libraries. This reduces the attack surface drastically (around two orders of magnitude). MirageOS is a unikernel project that uses OCaml, which also reduces the attack vectors (memory safety, type safety). MirageOS does not contain any process management, neither virtual memory – the entire unikernel is executed in single address space. The cooperative multitasking library lwt is used at the base.
MirageOS can be deployed to various modern hypervisors: Xen, Linux KVM, FreeBSD BHyve, OpenBSD VMM, virtio, as well as to the Genode microkernel-based operating system framework and the separation kernel Muen. It can also be run as a unix process with rather restrictive seccomp filters (less than 10 syscalls needed). It runs on X86-64, ARM64 (Raspberry PI), ESP32; RISC-V support is along its way.
Apart from core Internet Protocols (TCP/IP, DHCP, DNS, HTTP), security protocols (TLS, OpenPGP, OTR), and branchable distributed storage (implementing the git protocol) for persistency, several applications are work-in-progress:
- Calendar and address book (CalDAV/CardDAV) storing data in a remote git repository
- EMail (MIME encoding/decoding, SMTP, IMAP)
- VPN Gateway
In this tutorial, first I’ll briefly introduce the benefits of MirageOS and the programming environment - the mirage command line utility takes care of target-specific dependency, initialization order, etc. by generating code. Afterwards, we’ll dig deep down further examples.
You can follow the tutorial on a Linux, FreeBSD, OpenBSD, or macOS box. You won’t need a hypervisor to follow the tutorial, but will be able to utilize Linux KVM during the tutorial.
You will need the OCaml package manager, opam. To prepare:
- install opam >= 2.0.0
opam initand follow the instructions
- make sure you have OCaml >= 4.06.0 by running
- install MirageOS with
opam install mirage
For testing purposes, the mirage-skeleton repository hosts various example unikernels. Clone that and do a
mirage configure ; make depend ; make
in any of the subdirectories, and you should end up with a
mirage configure -t hvt to produce an unikernel
image that runs on KVM).
Hannes Mehnert researches in several engineering areas: from programming languages (such as compiler optimisation visualisation, type systems) over full functional correctness proofs of object-oriented code, the topic of his PhD dissertation, development environments for dependently typed languages, to network protocols (TCP/IP) and security protocols (TLS, OTR).
Since beginning of 2018, Hannes works on a non-profit to put MirageOS into production at robur. He used to be a postdoc at University of Cambridge working with the semantics, systems, and security group.