Containers should be an operating system responsibility
alexandrehtrb.github.io
alexandrehtrb.github.io
Instead of relying on a monolithic kernel to orchestrate containers, we can flip the script: run containers as unikernels: self-contained, single-purpose operating systems compiled with only the code they need.
This approach offers:
- Minimal attack surface: No unused syscalls, no bloated libraries.
- Blazing-fast boot times: Ideal for ephemeral workloads and scaling.
- Tighter resource control: No scheduler contention, no noisy neighbors.
What about system administration? Introduce a dedicated sysadmin container, a privileged unikernel equipped with diagnostic tools, monitoring agents, and secure access mechanisms. It becomes the only container with visibility into the host, enforcing the principle of least privilege across the rest of the system.
QNX, a real-time microkernel OS, is a perfect foundation for this architecture:
- Microkernel design: Only essential services run in kernel space; everything else is modular and isolated.
- Proven reliability: Used in mission-critical systems from automotive to aerospace.
- Deterministic behavior: Ideal for predictable container orchestration and real-time workloads.
QNX could act as the hypervisor or orchestration layer, launching unikernel containers as isolated processes or VMs, each with its own tailored runtime. The sysadmin container could interface with QNX’s message-passing architecture to manage and monitor the system without compromising isolation.
This model aligns with the broader trend toward immutable infrastructure and zero-trust security. By treating each container as a unikernel and system administration as just another service, we move toward a world where:
- The OS disappears into the background.
- Containers are sovereign, secure, and specialized.
- The system is easier to reason about, audit, and scale.
Bottom line: containers should not be an operating system responsibility. Operating systems should effectively go away.