Unikernels Were Hard. Key Word: Were

TL;DR

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

In a published conversation with Justin Cormack, developer Geoffrey Huntley argues that AI coding tools may make unikernels easier to build by helping port missing libraries and tools. The discussion presents this as a possibility, not proof that unikernels are now easy or more secure in practice.

Developer Geoffrey Huntley argues that AI coding tools could make unikernels more practical by helping engineers write or port the libraries and system utilities these minimal application environments often lack. The argument appears in a report about a conversation with Justin Cormack, a veteran of MirageOS and Unikernel Systems; it describes a potential shift in development effort, not evidence that AI has resolved unikernels’ operational or security challenges.

A unikernel packages an application with the system components it needs, rather than running it atop a conventional operating system with a broad userland. Huntley says that architecture was difficult to work with because developers had to implement many functions as libraries instead of relying on familiar programs and tools. Cormack recalled that the Mirage project had TCP and HTTPS stacks but few storage options, and at times used drivers taken from NetBSD.

Huntley’s central claim is that AI coding agents may reduce the cost of filling such gaps. He gives the example of porting a library from one programming language to another, and Cormack describes using an agent to write a Rust tool that creates XFS filesystems. According to Huntley’s account, the new tool’s output was compared with the existing utility across block sizes and options. The source says the work took a few hours; it does not provide an independent evaluation of the result.

The report also discusses using S3-compatible object storage for persistent data, with local NVMe storage acting as a cache, and using Nix machine tests to exercise systems across multiple machines. These are approaches the participants favor, not findings from a published benchmark or deployment study. The source does not identify a specific product announcement, release, or adoption figure.

AI Could Lower Unikernel Porting Costs

If AI agents can reliably port libraries and reproduce the behavior of existing utilities, they could reduce one practical barrier to building small, application-specific systems. That may make the unikernel model worth revisiting for teams that previously lacked time or ecosystem support, especially where a narrow software footprint is desirable.

Huntley also links the architecture to reducing exposed software: a system without a general-purpose shell or userland may leave an attacker fewer familiar tools after an initial compromise. Cormack cautions that attack-surface reduction is not simple to measure. Removing a shell does not eliminate interpreters, memory-safety flaws, or other ways to execute code. The security case remains an argument to test, not a demonstrated outcome of AI-assisted development.

MirageOS and the Old Ecosystem Gap

Huntley says he first experimented with unikernels around 2015, after working with functional programming languages and encountering MirageOS, an OCaml-based project. The defining idea is that the application itself incorporates the operating-system functionality it needs. There is no standard userland from which an application can simply launch familiar programs.

That design can limit dependencies, but it also means teams must supply functionality that conventional systems provide as separate programs or services. The conversation contrasts that earlier shortage of libraries and storage tools with current AI coding systems. It does not establish that the tooling gap has disappeared, or that generated code is automatically secure, correct, or maintainable.

“Unikernels were hard. Key word: were.”

— Geoffrey Huntley

Security and Reliability Remain Open

The report offers examples and informed opinions, but no controlled comparison of AI-assisted unikernel development against conventional approaches. It does not specify which AI models or versions were used, provide the generated code, or report independent review of the XFS utility. Whether agents can consistently produce correct, secure ports across larger projects remains unclear.

It is also unresolved how much security advantage a unikernel provides in real deployments. As Cormack’s response emphasizes, removing a shell is not the same as removing every route to code execution or every exploitable component. The source gives no incident data, measured attack-surface comparison, or evidence that organizations are adopting unikernels more widely because of AI.

Evidence Needed From Real Deployments

The next meaningful test would be published, reproducible work showing whether AI-assisted ports pass comprehensive tests, receive security review, and remain maintainable in production. Teams considering the approach would also need to measure deployment complexity and compare the resulting systems’ exposed components and failure modes with their existing environments.

Huntley says Cormack is conducting a series of conversations about renewed interest in unikernels. The source does not give dates for further installments or describe a product launch. For now, the development is a renewed technical argument: AI may make old engineering work cheaper, but practical adoption and security benefits still need evidence.

Key Questions

What is a unikernel?

A unikernel packages an application with the system components it needs, rather than relying on a conventional operating system userland with separate programs such as shells and utilities.

What has changed, according to Huntley?

Huntley argues that AI coding agents can help write missing libraries and port existing software, potentially easing the development work that once made unikernels difficult to use.

Does the report prove that AI makes unikernels secure?

No. The report presents a security argument and an example of AI-assisted tool development, but it provides no independent security evaluation or deployment data. Cormack also notes that removing a shell does not remove all attack paths.

What remains unconfirmed?

The report does not establish how reliably agents can produce production-ready ports, whether the cited filesystem tool passed independent review, or whether AI is driving wider unikernel adoption.

Source: hn