Also prior art: the Nemesis operating system. <a href="http:&#x2F;&#x2F;www.cl.cam.ac.uk&#x2F;research&#x2F;srg&#x2F;netos&#x2F;projects&#x2F;archive&#x2F;nemesis&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cl.cam.ac.uk&#x2F;research&#x2F;srg&#x2F;netos&#x2F;projects&#x2F;archive&#x2F;...</a><p>Nemesis has a single address space <i>and</i> memory protection: you can twiddle the permission bits in MMUs without necessarily incurring the cost of a TLB flush.<p>A unikernel system is usually a single-application system with no local multiuser capability; security is applied at the virtualisation layer and within the application. This is quite different from the traditional timesharing model.