Well that's not a unikernel though, and is basically what firecracker-containerd does. You still have to traverse the syscall boundary which has a performance hit.