A Unikernel Firewall for QubesOS

lotuseclat79 · Jan 1, 2016

A Unikernel Firewall for QubesOS

QubesOS provides a desktop operating system made up of multiple virtual machines, running under Xen. To protect against buggy network drivers, the physical network hardware is accessed only by a dedicated (and untrusted) “NetVM”, which is connected to the rest of the system via a separate (trusted) “FirewallVM”. This firewall VM runs Linux, processing network traffic with code written in C.

In this blog post, I replace the Linux firewall VM with a MirageOS unikernel. The resulting VM uses safe (bounds-checked, type-checked) OCaml code to process network traffic, uses less than a tenth of the memory of the default FirewallVM, boots several times faster, and should be much simpler to audit or extend.
Click to expand...

-- Tom

Log in or Sign up

A Unikernel Firewall for QubesOS

lotuseclat79 Registered Member

Log in or Sign up

A Unikernel Firewall for QubesOS

lotuseclat79 Registered Member

Useful Searches