There are use cases where running a unikernel in isolated userspace can be advantageous. I'm building a multitenant routing and packet forwarding framework. The Linux kernel has matured to the point that it can handle routing logic efficiently, without the need for any application to listen for packets. Network namespaces further enable multitenancy of routing and packet forwarding. Of course, it would be nice to launch short-lived, stateless applications like L4-7 load balancers into those namespaces. I would like to use containers for this, because "boot" times are faster than any VM. However in a multitenant environment where security is critical, the greater attack surface of containers worries me. I want to mitigate the situation by running applications in unikernels to minimize the attack surface.

Or am I totally wrong in thinking containers are necessary here? Is the boot time of a VM limited by the kernel on the guest, or the hypervisor on the host? Do unikernels solve the slow boot problem of VM's entirely?