The Final Build
A unikernel is the practical realization of the LibraryOS concept — a single, bootable machine image containing exactly one application and exactly the OS libraries that application requires, and nothing else.
Here is the recipe for creating one:
- Start with your application code. This is the program you want to run — a web server, a DNS resolver, a message queue consumer.
- Select only the OS libraries your application needs. Need TCP/IP? Include the networking library. Need to read files? Include a filesystem library. Don't need either? Include neither.
- Compile and link everything together into a single, self-contained binary image.
- Boot the image directly on a hypervisor (like Xen or KVM) or on bare metal hardware.
The resulting image is not a container. It is not a VM running Linux. It is a purpose-built operating system that exists solely to run your one application.
Single Address Space
Because the unikernel runs only one application, there is no need for the CPU privilege separation between user space and kernel space. Everything runs in a single address space at the highest privilege level. This eliminates context switch overhead entirely and allows the compiler to optimize across application and OS library code simultaneously — something impossible when the kernel is a separate, pre-compiled binary.
What a Unikernel Is Not
A unikernel is not a stripped-down Linux container. It is not Alpine Linux with packages removed. It does not run a Linux kernel at all. It is a fundamentally different software architecture where the concept of "the OS" and "the application" merge into a single compiled artifact.