# MirageOS: robust and secure services for the cloud

- Institution: CERN
- Department: CERN Computing Seminar
- Speaker: Hannes Mehnert
- Year: 2019
- Language: English
- Subjects: Computer science
- Source: [CERN](https://videos.cern.ch/record/3010634)
- Licence: [CERN](http://copyright.web.cern.ch)
- Who can watch: Tweens profiles and older (sources give no ratings; placed by Invisible Network from the source's own words)

The MirageOS project develops single-purpose operating systems targeting hypervisors, also named a unikernel or library operating system. Each unikernel is specialised at compile-time by the composition of available libraries. There are multiple advantages of MirageOS, e.g. its tiny attack surface - the binary size of a MirageOS unikernel is 4% compared to a UNIX-based operating systems; less complexity - avoiding process management, scheduler, virtual memory. MirageOS was started in 2008 at University of Cambridge, and is written in the functional statically-typed programming language OCaml, which avoids common attack vectors (spatial and temporal memory safety issues such as buffer overflows and use-after-free). In addition, we are working on common best security practises: cryptographically signed supply chain, reproducible builds.

MirageOS unikernels can be deployed on commodity hypervisor (Xen, KVM, FreeBSD BHyve, OpenBSD VMM), virtio, as Linux processes with strict seccomp rules, on the separation kernel muen.sk, or on the operating system framework GenodeOS that uses a microkernel. The backends, apart from Xen, use Solo5 which was initially developed with MirageOS in mind.

Apart from core Internet Protocols (TCP/IP, DHCP, DNS, HTTP), security protocols (TLS, OpenPGP, OTR), and branchable distributed storage (implementing the git protocol) for persistency, we are developing several applications:

Calendar and address book (CalDAV/CardDAV) storing data in a remote git repository

EMail (MIME encoding/decoding, SMTP, IMAP)

Firewall (currently mainly for QubesOS)

OpenVPN gateway

Other applications and libraries are available in various states of development - from unreleased to mature. MirageOS is a collection of OCaml libraries, currently around 150, of which nearly all MirageOS libraries and tooling is released under MIT/ISC/BSD 2 clause licenses, and freely available.

Some MirageOS libraries (e.g. DNS, TCP/IP) have been deployed as part of Docker for…

## Lectures

1. [MirageOS: robust and secure services for the cloud](https://invisiblenetwork.ai/learn/cern/3010634/77e793566f53), 1 h 18 min (CERN's player)