MirageOS: robust and secure services for the cloud

<!--HTML--><p>The MirageOS project develops single-purpose operating systems targeting hypervisors, also named a unikernel or library operating system. Each unikernel is specialised at compile-time by the composition of available libraries. There are multiple advantages of MirageOS, e.g. its tiny attack surface - the binary size of a MirageOS unikernel is 4% compared to a UNIX-based operating systems; less complexity - avoiding process management, scheduler, virtual memory. MirageOS was started in 2008 at University of Cambridge, and is written in the functional statically-typed programming language OCaml, which avoids common attack vectors (spatial and temporal memory safety issues such as buffer overflows and use-after-free). In addition, we are working on common best security practises: cryptographically signed supply chain, reproducible builds.</p> <p>MirageOS unikernels can be deployed on commodity hypervisor (Xen, KVM, FreeBSD BHyve, OpenBSD VMM), virtio, as Linux processes with strict seccomp rules, on the separation kernel muen.sk, or on the operating system framework GenodeOS that uses a microkernel. The backends, apart from Xen, use <a href="https://github.com/solo5/solo5" target="_blank">Solo5</a> which was initially developed with MirageOS in mind.</p> <p>Apart from core Internet Protocols (TCP/IP, DHCP, DNS, HTTP), security protocols (TLS, OpenPGP, OTR), and branchable distributed storage (implementing the git protocol) for persistency, we are developing several applications:</p> <ul> <li>Calendar and address book (CalDAV/CardDAV) storing data in a remote git repository</li> <li>EMail (MIME encoding/decoding, SMTP, IMAP)</li> <li>Firewall (currently mainly for QubesOS)</li> <li>OpenVPN gateway</li> </ul> <p>Other applications and libraries are available in various states of development - from unreleased to mature. MirageOS is a collection of OCaml libraries, currently around 150, of which nearly all MirageOS libraries and tooling is released under MIT/ISC/BSD 2 clause licenses, and freely available.</p> <p>Some MirageOS libraries (e.g. DNS, TCP/IP) have been deployed as part of Docker for Mac and Docker for Windows (vpnkit, etc.) which has millions of users on a daily basis.</p> <p><strong>About the speaker</strong></p> <p>Hannes Mehnert researches in several engineering areas: from programming languages (such as compiler optimisation visualisation, type systems) over full functional correctness proofs of object-oriented code, the topic of his PhD dissertation, development environments for dependently typed languages, to network protocols (TCP/IP) and security protocols (TLS, OTR).</p> <p>In his spare time, Hannes is not only a hacker, coauthor of a book on indian cuisine and functional programming in JavaScript, but also a barista and likes to travel and repair his recumbent bicycle.</p> <p>Since beginning of 2018, Hannes works on a non-profit to put MirageOS into production at robur. He used to be a postdoc at University of Cambridge working with the semantics, systems, and security group.</p>