Osv

OSV is a unikernel operating system and cloud-native execution environment designed to run as a secure microVM on hypervisors such as KVM, Firecracker, Xen, and VMware. It functions as a Linux binary compatible runtime, allowing unmodified Linux binaries to be executed as secure microVMs without requiring recompilation.

The project distinguishes itself through its ability to package applications into minimal bootable images and its provide of a virtual machine management API. This REST interface enables remote monitoring of system health, management of execution traces, and control over guest virtual machine states.

The system covers a broad range of low-level capabilities, including symmetric multiprocessing scheduling, a channel-based network stack, and virtual device integration. It includes comprehensive observability tools for memory leak detection, CPU usage sampling, and network packet tracing, alongside support for various boot filesystems and persistent block storage management.

Features

Binary Compatibility Layers - Provides a compatibility layer that allows unmodified Linux binaries to execute within a minimal unikernel environment.
Binary Workload Execution - Executes unmodified Linux binaries as secure microVMs without requiring recompilation.
MicroVM Runtimes - Provides a secure execution environment for running unmodified Linux binaries as lightweight, hardware-isolated microVMs.
Virtual Hardware Interfaces - Provides control surfaces for managing virtualized network, disk, and random number devices across multiple hypervisors.
Network Stacks - Implements a specialized channel-based network stack designed to reduce lock contention in multi-processor environments.
CPU Schedulers - Implements a symmetric multiprocessing scheduler to distribute multithreaded workloads across multiple virtual CPUs using load balancing.
Multi-Format Boot Loaders - Provides a boot loader capable of initializing the system across multiple virtualization formats like PVH and HVM.
Virtual Device Management - Implements a layer for abstracting physical hardware into virtual device interfaces for block storage and networking.
Symmetric Multi-Processing - Coordinates kernel execution and task scheduling across multiple virtual CPUs using symmetric multiprocessing.
Symmetric Multiprocessing Mechanisms - Implements kernel-level symmetric multiprocessing to distribute multithreaded workloads across multiple virtual CPUs.
TCP/IP Stacks - Implements a channel-based TCP/IP network stack to reduce lock contention on multi-processor virtual machines.
Unikernel Build Toolchains - Implements toolchains to bundle application code with minimal kernel drivers into a single bootable unikernel image.
Unikernel Image Packaging - Bundles Linux applications and dependencies into minimal, bootable unikernel images for cloud deployment.
Unikernels - Combines applications and minimal kernel components into a single bootable unikernel binary image.
VirtIO Driver Implementation - Integrates standardized VirtIO drivers for efficient communication with virtualized block storage and network hardware.
Secure MicroVM Instances - Designed to run as a secure microVM on hypervisors such as KVM, Firecracker, Xen, and VMware.
Cloud Native Runtimes - Provides a lightweight runtime optimized for high-performance networking and multithreaded workloads in cloud environments.
Linux Compatibility Layers - Implements a Linux compatibility layer to deploy standard applications as secure microVMs without modification.
Call Graph Generators - Generates annotated call graphs to visualize code path frequency and function execution time.
AArch64 Linux Runtimes - Enables the execution of unmodified Linux binaries on ARM64 architecture using QEMU and Firecracker.
Lock Contention Analysis - Identifies contended mutexes by measuring the time threads remain blocked after failed lock attempts.
Hypervisor Deployment Targets - Ensures the unikernel can be deployed as a secure microVM on KVM and MSHV hypervisors.
Virtual Machine Lifecycle Management - Offers tools for controlling the operational state and configuration of microVMs via a REST API.
Packet Capture Implementations - Captures incoming and outgoing network packets from the wire in a human-readable format.
Network Stack Bypasses - Bypasses standard socket APIs and transport layers to increase throughput and reduce networking latency.
REST Administrative APIs - Provides an administrative REST API for guest tasks such as monitoring threads and rebooting.
System Debugging - Allows connecting remote debuggers to analyze system traces and investigate machine-code level behavior.
Filesystem Type Support - Supports loading system data and applications from diverse storage backends including RAMFS, ROFS, ZFS, and Virtio-FS.
Boot Filesystem Configurations - Allows selecting the filesystem type for application images or mounting external storage via NFS and Virtio-FS during boot.
Guest Host Filesystem Sharing - Mounts host directories as shared filesystems to allow real-time content updates without rebuilding images.
Huge Page Optimizations - Utilizes large memory pages to increase processing efficiency and implement demand paging.
Memory Allocation Tracers - Tracks heap allocation sizes to identify internal fragmentation and high memory usage patterns.
Low-Overhead System Profilers - Provides high-performance system profiling for CPU cycles, memory allocations, and lock contention with minimal overhead.
Performance Counter Sampling - Performs timer-based stack sampling to provide a statistical overview of CPU activity and hotspots.
Virtualization Networking - Supports virtual network connectivity through user-mode networking, tap devices, and static IP configurations.
REST APIs - Provides a standardized HTTP interface for launching and orchestrating virtual machine executables.
Package Dependency Resolution - Scans host filesystems to identify and resolve all shared library dependencies required by a Linux executable.
Execution Time Measurements - Measures duration between paired tracepoints to identify latency bottlenecks and generate timing summaries.
Memory Error Detection - Detects use-after-free errors by triggering segmentation faults during invalid memory access.
REST Management APIs - Exposes system health, performance metrics, and administrative controls through a REST-based management API.
Static Event Markers - Implements static tracepoints for detailed performance profiling and system execution debugging.
Execution Tracing - Provides capabilities to extract and analyze low-level execution traces via GDB or a REST API.
Execution Tracing - Implements event recording via static tracepoints and function entries to visualize system execution flow.
Performance Profiling Tools - Analyzes CPU cycles and execution patterns using guest-aware sampling and profiling tools.
System State Management - Provides a management dashboard and API for monitoring and controlling the overall system health.
Memory Leak Detection - Identifies memory leaks by tracking allocations and detecting those remaining after execution finishes.

includeos/IncludeOS

5,239View on GitHub

IncludeOS is a unikernel operating system that bundles application code with only the necessary kernel drivers into a single bootable image. It functions as a resource-efficient cloud service virtual machine and a lightweight serverless runtime environment designed to minimize memory footprints and boot times. The project provides a Linux compatibility layer via a C library, allowing applications written for Linux to be compiled and executed within the unikernel environment. It also serves as a network appliance framework for building high-performance firewalls and load balancers using config

asterinas/asterinas

4,678View on GitHub

Asterinas is a memory-safe operating system kernel designed to prevent data races and memory corruption. It functions as a Linux-ABI compatible kernel, enabling the execution of existing Linux binaries and container workloads while providing a declarative operating system distribution model. The project distinguishes itself by acting as a virtual machine container host and a confidential computing guest OS, allowing it to run within hardware-isolated Trusted Execution Environments such as Intel TDX. It implements a minimal trusted computing base by isolating unsafe low-level operations and se

klange/toaruos

6,783View on GitHub

ToaruOS is an independent operating system built from the ground up without external dependencies. It features a custom x86-64 kernel that supports symmetric multiprocessing and paging, paired with a graphical windowing system and a dedicated bytecode interpreter for application logic. The system distinguishes itself by integrating an embedded Python environment for system-level development and a custom graphical interface that handles its own window composition and text rendering. It includes a compatibility layer for third-party application support and a system package manager for handling

firecracker-microvm/firecracker

34,954View on GitHub

Firecracker is a virtual machine monitor that leverages hardware-assisted virtualization to create and manage isolated execution environments. It functions as a lightweight runtime designed to launch virtual machines with minimal memory overhead and near-instantaneous startup times, providing the security of traditional hardware virtualization with the efficiency of containerized workloads. The project distinguishes itself through a security-focused architecture that enforces strict process boundaries using system-level barriers and restricted user privileges. It minimizes the attack surface

cloudius-systemsosv

Features