Library OSes vs Unikernels

Question

My understanding of a Hypervisor & Virtual Machines is that the hypervisor is a program (either running on top of a host OS, or running bare metal as the host) that leverages binary-compatible device drivers and a slew of other technologies to provide hardware emulation in the form of isolated "virtual" guest machines, all sharing the host's hardware and peripherals.

My understanding of Linux Containers is that the Linux kernel contains a native hypervisor that allows for this same type of functionality, but for some reason, is much more lightweight than traditional type I/II hypervisors and their VMs. My understanding is that Docker improves upon raw Linux container even more so, though I'm not sure exactly how.

My understanding of Library OSes is that they are bits and pieces of the many Linux libraries and packages out there, effectively allowing you to stitch together your own "Frankenstein" Linux distro from a minimized set of libraries specific to your app.

My understanding of Unikernel is that it is essentially the same thing as a Library OS, but are even (somehow?) more stipped down and minified.

My understanding of an immutable server is that its a server that is configured once at buildtime, and never changes its configuration or internal state after it starts running.

So first, if anything I have asserted so far is incorrect or misled, please begin by correcting me! Assuming I'm more or less on track with these:

• What is the exact difference between Library OSes and Unikernels?
• For that matter, what's the difference between both of these an "embedded" or "micro" versions of Linux (such as ArchLinux), designed for embedded systems? Aren't they all just "minified Linux"?
• Which of these is used to create an immutable server?

Answer 1

The intuition behind unikernels as possible with OpenMirage (a.k.a. MirageOS) is that you code a specialized "kernel" like program (running nearly on the bare metal, but actually) for some hypervisor like Xen which would run several dozens of such unikernels.

Notice that OpenMirage unikernels share very little code (AFAIK, none) with Linux kernel (since they are mostly coded in Ocaml, not in C!); for example their TCP stack is different.

Library OS is nearly a buzzword not meaning much. Read e.g. about the exokernel idea. The OSkit project (dead since 2003, probably) packaged Linux kernel subsystems and drivers to provide people with some libraries to make kernel like software.

Some specialized variants of Linux distributions enable you to use a bare linux kernel with very few specific utilities (but then you are using a common Linux kernel, perhaps with your own init-like program, or just with very few specialized programs started by some usual init or systemd thing). Many embedded Linux (including Android) are used this way, e.g. OpenWRT, but the user-land software is doing ordinary Linux syscalls listed in syscalls(2).

docker is a software container (i.e. some kind of operating system level virtualization or sandbox). See also Chroot, and the chroot(2) & personality(2) & setns(2) syscalls.

Read also about (Linux-specific) credentials(7), capabilities(7), namespaces(7)