Sorry but the security "win" of unikernels are not binary.
Yes, in theory you have a smaller attack surface, in practice its not exactly true.
Yes, you throw away a lot of tools that you don't need, which means that sideways traversal is much much harder, it doesn't actually stop your front door being smashed down.
You are also on the hook for detecting and updating any ported library. This sounds easy right? just look for the CVEs and then re-build the image?
Ok but what version of the ported library is in your unikernel? in the porting did it have the same bug? Did the LLM cock up the porting, did
Basically you are on your own. So saying "unikernels! you're secure now" is at best misleading.
Yes, in theory you have a smaller attack surface, in practice its not exactly true.
Yes, you throw away a lot of tools that you don't need, which means that sideways traversal is much much harder, it doesn't actually stop your front door being smashed down.
You are also on the hook for detecting and updating any ported library. This sounds easy right? just look for the CVEs and then re-build the image?
Ok but what version of the ported library is in your unikernel? in the porting did it have the same bug? Did the LLM cock up the porting, did
Basically you are on your own. So saying "unikernels! you're secure now" is at best misleading.