We've been playing a lot with OSv. But unikernels aren't strictly sandboxing or isolation.
If you're deploying a unikernel to ec2, you're just using their underlying isolation. You can't safely deploy multiple unikernels on the same ec2 instances without figuring out your own, nested isolation.
Sure - the hypervisor is the isolation vehicle - the same as firecracker.
The only? reason I can see for wanting to deploy N unikernels to one AWS instance is if you want full control on the orchestration of things like multi-tenancy, however, it is very much possible and it is possible on GCloud as well. It should be noted that you are in the same boat as firecracker here. They both use virtualization.
Re:Sandboxing and workload isolation
by yencabulator on Friday July 31, 2020 @05:21PM
(#24014296)
The usual reason to want to do N things with 1 piece of hardware is cost savings.
"The first, and really the big problem for the whole virtualization approach, is that you need bare metal servers to efficiently do lightweight virtualization;" <- this isn't really true anymore as unikernels can be deployed to {aws, gcloud, azure} as machine images and so can be as light-weight as your program needs.