I like the idea of the small attack service and minimal image size.  However, having a different kernel image for each service seems likely to trigger some extremely hard-to-diagnose bugs, which have to include performance problems.<p>As least with conventional OS you have a chance to get in and figure out what&#x27;s going on.  With Unikernels it sounds as if you may end up with either a core dump (how?) or a misbehaving  service you can&#x27;t access to diagnose problems.