unikernel是否已准备好用于边缘无服务器计算？
Are Unikernels Ready for Serverless on the Edge?
AI总结：
研究探讨unikernel用于边缘无服务器计算的适用性，对比其与Docker、microVM等沙箱的性能，发现unikernel冷启动性能优但稳定性不足，是Linux兼容FaaS隔离研究的有前景候选。
摘要：
函数即服务（FaaS）是一种很有前景的边缘计算执行模型，但需要安全的沙箱机制来在受限基础设施上隔离来自多个租户的工作负载。尽管Docker容器在开源FaaS平台中轻量且流行，但通常被认为不足以执行不可信代码和提供沙箱隔离。因此，商业云FaaS平台依赖Linux微虚拟机（microVM）或加固的容器运行时，这些虽然安全但资源占用更高。unikernel将应用代码和有限的操作系统原语组合成单一用途的设备，在提供完整Linux兼容性的同时减少了应用及其沙箱的占用。本文使用Nanos和OSv unikernel工具链研究unikernel作为边缘FaaS执行环境的适用性，比较了冷启动开销、空闲占用等指标，与Firecracker Linux微虚拟机、Docker容器、安全gVisor容器等沙箱相比，发现unikernel具有理想的冷启动性能，但稳定性落后于Linux微虚拟机，不过仍是Linux兼容FaaS隔离进一步研究的有前景候选。
英文摘要：
Function-as-a-Service (FaaS) is a promising edge computing execution model but requires secure sandboxing mechanisms to isolate workloads from multiple tenants on constrained infrastructure. Although Docker containers are lightweight and popular in open-source FaaS platforms, they are generally considered insufficient for executing untrusted code and providing sandbox isolation. Commercial cloud FaaS platforms thus rely on Linux microVMs or hardened container runtimes, which are secure but come with a higher resource footprint. Unikernels combine application code and limited operating system primitives into a single purpose appliance, reducing the footprint of an application and its sandbox while providing full Linux compatibility. In this paper, we study the suitability of unikernels as an edge FaaS execution environment using the Nanos and OSv unikernel tool chains. We compare performance along several metrics such as cold start overhead and idle footprint against sandboxes such as Firecracker Linux microVMs, Docker containers, and secure gVisor containers. We find that unikernels exhibit desirable cold start performance, yet lag behind Linux microVMs in stability. Nevertheless, we show that unikernels are a promising candidate for further research on Linux-compatible FaaS isolation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
