I&#x27;m happy for this article because it does hit some points on the head. Other points are deeply entrenched in Bryan&#x27;s biases, but I can&#x27;t really fault him for that.<p>In particular, I am suspicious of the idea that unikernels are more secure. Linux containers make the application secure in several ways that neither unikernels nor hypervisors can really protect from. Point being a unikernel (as defined) can do anything it wishes to on the hardware. There is no principle of least-privilege. There are no unprivileged users unless you write them into the code. It&#x27;s the same reason why containers are more secure than VMs.<p>Users are only now, and slowly, starting to understand the idea that containers can be more secure than a VM. False perspectives and promises of unikernel security only conflate this issue.<p>That said, I do think the problems with unikernels might eventually go away as they evolve. Libraries such as Capsicum could help, for instance. Language-specific or unikernel-as-a-vm might help. Frameworks to build secure unikernels will help. Whatever the case, the problems we have today are not solved or ready for protection -- yet.<p>This blog post was clearly spurred by the acquisition made by Docker (of which I am alumnus). I think it&#x27;s a good move for them to be ahead of the technology, despite the immediate limitations of the approach.