Your service with no operating system
A unikernel is one self-contained program that runs directly on a virtual server (KVM), with no Linux, no shell and no processes. We adapt your service to run on such a foundation, and you start it from one disk image. We developed the foundation ourselves and proved it on our own product, the MQTT broker urMQTT.
Advantages
A small attack surface
One statically linked image with no operating system, shell or user processes; only what the service needs is opened. Components you cannot fully trust (for example a C library) can run isolated, in an address space of their own with no access to the kernel.
Less to maintain
No operating system to patch and upgrade: a new version is a new image. The image is only a few megabytes.
Fewer parts, fewer surprises
Behaviour is set by one program and its configuration; there are no background services, packages or things that start on their own.
Configuration is data
Settings and certificates are packed into a validated configuration that is checked at every start; the image prints a fingerprint of its configuration, so you can check it is the one you ordered.
Security is built into the foundation
TLS 1.3 with mutual authentication, protection against network floods, resource limits and a watchdog keep one bad client from stopping the rest; storage is tested with a power cut at every write, with optional disk encryption.
Verifiable, with no lock-in
Reproducible builds, signed releases, a software bill of materials (SBOM), open source foundation and an audit package that also lists the known weaknesses.
Fits small and large setups
The same code runs on aarch64 and x86_64 virtual servers.
What we offer
Price for all: on request
Feasibility assessment
We review your service (language, dependencies, network and disk needs) and tell you what is possible, what has to change and how much work it is, before you commit to anything else.
Adapting your service to the unikernel
We port the service (easiest in Rust; C libraries in an isolated worker) onto our foundation: networking, TLS, storage, configuration and logging.
A pilot on your server
We run the service on your infrastructure (KVM), try it with your traffic and hand over a performance report.
Support and maintenance
Image upgrades, handling of reported vulnerabilities and training for your team.
urMQTT as a ready product
If you need an MQTT broker: a configured, signed image with your certificates.
A good candidate, and a poor one
Good: a single-purpose service that accepts network connections: a protocol server, a gateway, a data collector, a TLS endpoint, an edge appliance. Poorer: a program that needs the Linux ecosystem, a filesystem, many processes or a large number of outgoing connections. Today's foundation accepts connections (a TCP server), does not open outgoing TCP connections and supports IPv4 only; extensions are assessed per project.
Platforms and languages: what we support today
| Platform | Status |
|---|---|
| KVM virtual servers, aarch64 | Verified (Apple HVF and TCG) |
| KVM virtual servers, x86_64 (UEFI and BIOS) | Run on a real KVM VPS (AMD EPYC), plus emulator tests; not tried on physical hardware |
| Virtual devices | virtio (network, disk, SCSI, random numbers) |
| Network | IPv4; TCP as a server (accepts connections, does not open outgoing ones) |
| Physical servers (bare metal), VMware, Hyper-V, Xen | Not supported (yet) |
| Service language | Status |
|---|---|
| Rust | The natural choice: the whole foundation is in Rust |
| C | Only as an isolated program with our small libc layer (this is how SQLite runs); not POSIX |
| C++ | Possible as C, unproven; assessed per project |
| Go, Java, Python, Node.js, .NET, PHP | Not supported: they need an operating system. Then the service is rewritten in Rust, or stays on Linux with a unikernel gateway at the edge |
What you should know up front
The foundation is early (pre-1.0). It targets KVM virtual servers; x86_64 has run on a real KVM VPS and in an emulator, but not on physical hardware; Secure Boot is partial, and no independent security audit has been done yet. That is why we offer a pilot with support, not a certified product.
Example: urMQTT
An MQTT broker on that foundation: TLS 1.3 with mutual authentication, certificate revocation without a new image, an isolated SQLite database, optional disk encryption. Read the source on GitHub or contact us.