When using a unikernel design there is no isolation between a single node software components like an OS can provide. All the code share the same memory space.<p>Isolation can be useful. For example the Postfix email server (running on a Unix, not unikernel) is decomposed into several processes with different privileges. That allows running the most sensitive parts with limited access rights, to protect against attacks, while still running those parts on the same server for efficiency. This process isolation is typically not provided with unikernels.<p>A lot of unikernels compensate for this by providing language level protection, by using safe high level language (see MirageOS using OCaml, other based on Erlang, haskell or rust). Then it&#x27;s not process isolation but the language and its implementation that guarantee that provides protection &#x2F; isolation between components.
My understanding is that is what GP refers too.<p>A unikernel based on C or C++ will have no process isolation, and no language level isolation either. So sensitive components would have to be split into different nodes, isolated by using either separate VMs or machines. That&#x27;s doable, but adds complexity to the orchestration and possibly some overhead.