About
The MirageOS project develops single-purpose operating systems targeting hypervisors, also named a unikernel or library operating system. Each unikernel is specialised at compile-time by the composition of available libraries. There are multiple advantages of MirageOS, e.g. its tiny attack surface - the binary size of a MirageOS unikernel is 4% compared to a UNIX-based operating systems; less complexity - avoiding process management, scheduler, virtual memory. MirageOS was started in 2008 at University of Cambridge, and is written in the functional statically-typed programming language OCaml, which avoids common attack vectors (spatial and temporal memory safety issues such as buffer overflows and use-after-free). In addition, we are working on common best security practises: cryptographically signed supply chain, reproducible builds.
MirageOS unikernels can be deployed on commodity hypervisor (Xen, KVM, FreeBSD BHyve, OpenBSD VMM), virtio, as Linux processes with strict seccomp rules, on the separation kernel muen.sk, or on the operating system framework GenodeOS that uses a microkernel. The backends, apart from Xen, use Solo5 which was initially developed with MirageOS in mind.
Apart from core Internet Protocols (TCP/IP, DHCP, DNS, HTTP), security protocols (TLS, OpenPGP, OTR), and branchable distributed storage (implementing the git protocol) for persistency, we are developing several applications:
Calendar and address book (CalDAV/CardDAV) storing data in a remote git repository
EMail (MIME encoding/decoding, SMTP, IMAP)
Firewall (currently mainly for QubesOS)
OpenVPN gateway
Other applications and libraries are available in various states of development - from unreleased to mature. MirageOS is a collection of OCaml libraries, currently around 150, of which nearly all MirageOS libraries and tooling is released under MIT/ISC/BSD 2 clause licenses, and freely available.
Some MirageOS libraries (e.g. DNS, TCP/IP) have been deployed as part of Docker for…
The talk
Credits and licence
- Institution
- CERN
- Department
- CERN Computing Seminar
- Speaker
- Hannes Mehnert
- Year
- 2019
- Language
- English
- Subjects
- Computer science
- Source
- CERN
- Licence
- CERN, as CERN states it. CERN's terms
- Attribution
- © CERN. CERN provides its audiovisual media free of charge for educational and informational use, credited to CERN; this lecture is shown in CERN's own player.
- Who can watch
- CERN gives no rating. Invisible Network shows it to Tweens profiles and older, judged from what the source says about it. How courses are placed