As far as security is concerned a unikernel with lower attack surface will beat out a general kernel. A unikernel for AppX will have a completely different attack surface from AppY so most generalized attacks just won&#x27;t work. Shell attacks like heartbleed won&#x27;t work because there is no shell. Given that there&#x27;s a single process, even if you did compromise the system there&#x27;s not a whole lot you can do with it.