&gt; A unikernel for AppX will have a completely different attack surface from AppY so most generalized attacks just won&#x27;t work.<p>If unikernal systems do become popular, it&#x27;s very likely this would not be true because AppX and AppY would likely share a popular library that they&#x27;ve both been statically linked against. (Ex: An HTTP library with TLS).  Granted, the footprint of exploitable features would be considerably smaller<p>I agree more with the the latter point that a compromised system would probably offer very little for an attacker to leverage.