The idea is that your security boundary is at the VM.  The VM hypervisor presents a virtual CPU; malicious code cannot jump out of the box.<p>Many common server frameworks build in multiprocessing to the language runtime: Node.js mandates an event-driven callback style, Go has goroutines, etc.  So it already exists in userland.  Unikernels avoid duplicating that functionality at the kernel level, so the two systems don&#x27;t fight each other.<p>The hypervisor proxies device drivers through from the host operating system (running in Dom0) to the guest operating systems.<p>The idea is to run eg. Node, or Postgres, or memcached on bare metal.  So instead of write() trapping into the operating system, it becomes a library function that directly talks to the underlying device driver.  The <i>only</i> process the VM runs would be that one application, and you&#x27;d rely on the hypervisor to schedule multiple applications on one physical box.