this reminds me of a recent presentation posted here about OpenBSD&#x27;s coming support for &quot;pledges&quot; [1].<p>I suppose the difference here is that pledges use a single kernel but restrict kernel interfaces for each process while the unikernel approach creates a kernel subset for each VM (and thus each process, for VMs dedicated to a single process).<p>Can anyone knowledgeable comment about the advantages or disadvantages of each? I&#x27;m guessing unikernals will be more portable (only OpenBSD is doing pledges to my knowledge) and more popular with the containerization movement. Can pledges accomplish the same objective with better use of system resources?<p>Edit: clarity about portability point<p>[1] <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;cgi-bin&#x2F;man.cgi&#x2F;OpenBSD-current&#x2F;man2&#x2F;pledge.2" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;cgi-bin&#x2F;man.cgi&#x2F;OpenBSD-current&#x2F;man2&#x2F;...</a>