Unikernels collapse the traditional operating system boundary by making the application itself the OS, with no userland to fork or spawn. As Huntley recalls from 2015 work on MirageOS with Haskellers, this approach was difficult because while TCP and HTTPS stacks existed, storage libraries were nearly absent, forcing developers to pull drivers from NetBSD just to achieve basic functionality, reinforcing the industry dogma that unikernels were hard.
This image illustrates the unikernel concept where the application itself functions as the operating system without traditional userland
AI has overturned that difficulty by treating existing implementations as a “golden oracle” for automated porting: generate filesystems with both implementations, diff them, and port tests across. Huntley exemplifies this by porting Go’s Stripe library to OCaml and creating a Rust mkfs.xfs that matches the C original byte‑for‑byte in a few hours, turning library porting into a simple loop when an oracle exists. He further pairs this with a turbopuffer storage model—using S3 as infinitely growable primary storage backed by a local NVMe block cache and LRU cache for hot data—and applies Nix machine tests to exercise network rules across fleets of machines, fixing upstream issues via overlays, while his Spaceleans project shows a distributed unikernel OS by porting Microsoft Orleans to OCaml, yielding an Erlang‑like actor system with a filesystem layer built in a week.
The security upside is a markedly reduced attack surface: without a shell or interpreter, an attacker lacks any next hop if the needed functionality is not inside the application. Huntley notes, however, that Justin pushed back on the simplicity of this claim, pointing out that Linux containers still retain effective interpreters and that memory‑safety gadgets remain relevant, so the security gain is real but not absolute, leaving trade‑offs around verification, performance, and debugging that the article does not resolve.
This image depicts the Nix overlay approach mentioned in the article for fixing upstream issues across machine fleets