Sure, but what about private state in the unikernel? If I exploit it, I have access to everything inside it without restriction, I could even change the way the drivers work totally transparently to the rest of the software.<p>Is the idea that a single unikernel is equivalent to a single process? Surely we&#x27;re getting into realms of serious performance issues if that&#x27;s the case?<p>I do take your point on there being less going on meaning there is less to attack, and what you are saying is very interesting, don&#x27;t get me wrong :) I&#x27;m just trying to understand it.<p>There have been hypervisor exploits, but of course far fewer than linux&#x2F;windows&#x2F;mac escalations