&gt; That allows running the most sensitive parts with limited access rights, to protect against attacks, while still running those parts on the same server for efficiency. This process isolation is typically not provided with unikernels.<p>Unikernels also don&#x27;t have notions of access rights. To make that model work, more than memory safety, you need declarative ways of asserting constraints, which... C++ arguably can pull off pretty well.<p>&gt; A unikernel based on C or C++ will have no process isolation, and no language level isolation either.<p>C++ has lots of support for language level isolation. Yes, due to C compatibility, if you diddle with memory you can find ways to violate those contracts, but it is entirely possible, particularly in a unikernel context, to prove that you aren&#x27;t doing that.<p>&gt; That&#x27;s doable, but adds complexity to the orchestration and possibly some overhead.<p>That&#x27;d add way more complexity and likely bugs to the code than just keeping the codebase clean.