Docker / Kubernetes vs Unikernels
Some people think that Unikernels are just containers 2.0 but the reality is that they are incredibly different technologies.
DOCKER / KUBERNETES
- runs linux
- users
- 30M LOC
- many processes
- decreases performance
- less safe than linux
- higher complexity
UNIKERNELS
- NO shell
- NO linux
- NO users
- 30k LOC
- single process
- increases performance
- safer than linux
- simplicity
Unikernels are Faster
- Kubernetes and Docker are way slower than Linux because they duplicate both the storage and networking layers.
- NanoVMs relies on the underlying infrastructures existing network primitives so it isn't just faster than containers - it's faster than Linux itself.
- Unikernels can run 2X as fast as Linux on GCP and 3X as fast on AWS.
Unikernels are Safer
- Containers complicate the software supply chain.
- Containers break well-known Unix/VM security boundaries.
- Unikernels Reduce Attack Surface.
- Unikernels Make Compliance Much Easier.
| Security Requirement Guide | LINUX | NANOS | REDUCTION |
|---|---|---|---|
| OPERATION SYSTEM SECURITY REQUIREMENT GUIDE | 325 | 279 | 15% |
| GENERAL PURPOSE OPERATING SYSTEM SRG | 198 | 125 | 37% |
| RED HAT ENTERPRISE LINUX 7 | 23 | 21 | 9% |
| NISTIR 800-53 | 123 | 88 | 14% |
| NIST SP 800-44 | 54 | 31 | 43% |
| NISTIR 8176 | 224 | 193 | 14% |
Unikernels are Simple
- Unikernels remove layers of abstractions while containers add them.
- Unikernels use the cloud as the orchestration platform and don't require an external one like K8S.
- Unikernels are way easier to debug than containers.
Quick Start
It doesn't matter if you are using Mac, Linux, or WSL - you can boot your first unikernel right now in just a minute.
We've made it super easy for you to try it out and it's all free and open source.