[−]throwawayffffas · 2026-10-11 Sun 08:44 UTC ·
link
I generally agree Unikernels are cool as I did back in 2010 when I first came across the idea. But the idea that RCE are contained because there is no shell and no interpreter does not hold up. If they can run code on the machine they can run a compiler in your unikernel and device drivers and whatever else they will need. Granted it's much harder to do all these things through the straw of a RCE bug, but the argument that because the tools are not there they can't do damage is wrong their malicious code was not there either but they found a way to bring it in.