Unikernel cross-compilation
Building a unikernel is disclosed. Code is retrieved from a code repository. One or more unikernel build configuration options are identified. The code is analyzed to determine portions of an operating system required to execute the code. The code is compiled with the determined portions of the operating system into a unikernel that is deployable on a virtual machine to execute the code.
1. A system, comprising:
a processor configured to:
retrieve application code from a code repository;
identify one or more unikernel build configuration options;
analyze the retrieved application code;
based at least in part on the analysis of the application code:
determine one or more libraries required to execute the application code:
obtain pre-compiled versions of the determined one or more libraries required to execute the application code; and
modify the application code, wherein modifying the application code based at least in part on the analysis of the application code comprises modifying a system call in the application code, and wherein modifying the system call in the application code comprises at least one of removing the system call and rewriting the system call; and
compile the modified application code and the obtained pre-compiled versions of the determined one or more libraries into a unikernel image that is deployable on a virtual machine; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to obtain a previously verified version of a determined library.
3. The system of claim 2 , wherein the previously verified version of the determined library is hashed.
4. The system of claim 1 , wherein the processor is further configured to set one or more flags based at least in part on a determined library.
5. The system of claim 1 , wherein at least some of the one or more unikernel build configuration options are obtained from a build pack.
6. The system of claim 1 , wherein at least some of the one or more unikernel build configuration options are obtained via a user interface.
7. The system of claim 1 , wherein the one or more unikernel build configuration options include an indication of whether the unikernel image is associated with a mutable volume.
8. The system of claim 1 , wherein shed code is not permitted to execute after compiling the modified application code and the obtained pre-compiled versions of the determined one or more libraries into the unikernel image.
9. A method, comprising:
retrieving application code from a code repository;
identifying one or more unikernel build configuration options;
analyzing the retrieved application code;
based at least in part on the analysis of the application code:
determining one or more libraries required to execute the application code:
obtaining pre-compiled versions of the determined one or more libraries required to execute the application code; and
modifying the application code, wherein modifying the application code based at least in part on the analysis of the application code comprises modifying a system call in the application code, and wherein modifying the system call in the application code comprises at least one of removing the system call and rewriting the system call; and
compiling the modified application code and the obtained pre-compiled versions of the determined one or more libraries into a unikernel image that is deployable on a virtual machine.
10. The method of claim 9 , further comprising obtaining a previously verified version of a determined library.
11. The method of claim 10 , wherein the previously verified version of the determined library is hashed.
12. The method of claim 9 , further comprising setting one or more flags based at least in part on a determined library.
13. The method of claim 9 , wherein at least some of the one or more unikernel build configuration options are obtained from a build pack.
14. The method of claim 9 , wherein at least some of the one or more unikernel build configuration options are obtained via a user interface.
15. The method of claim 9 , wherein shell code is not permitted to execute after compiling the modified application code and the obtained pre-compiled versions of the determined one or more libraries into the unikernel image.
16. The system of claim 1 , wherein modifying the system call in the application code comprises removing a system call in the application code that causes a process to fork.
17. The system of claim 1 , wherein modifying the system call in the application code comprises rewriting a system call in the application code based at least in part on a determination of whether execution of the application code will fail, wherein the determination of whether execution of the application code will fail is based at least in part on the analysis of the application code.
18. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
retrieving application code from a code repository;
identifying one or more unikernel build configuration options;
analyzing the retrieved application code;
based at least in part on the analysis of the application code:
determining one or more libraries required to execute the application code:
obtaining pre-compiled versions of the determined one or more libraries required to execute the application code; and
modifying the application code, wherein modifying the application code based at least in part on the analysis of the application code comprises modifying a system call in the application code, and wherein modifying the system call in the application code comprises at least one of removing the system call and rewriting the system call; and
compiling the modified application code and the obtained pre-compiled versions of the determined one or more libraries into a unikernel image that is deployable on a virtual machine.