I couldn't sleep tonight, so naturally my mind wandered to what kinds of things I'd like to end up doing.

I've long been fascinated by the works of companies such as Harlequin, Raven Brook, and Galois. Quite frankly, I'm sick of the status quo in software. We're still running operating systems designed in the 70s that constantly present new security flaws and hold us back. Good enough is the enemy of progress, and though our current technologies served us well (arguably), I'd like to keep moving forward. Yes, it would mean invalidating most of the things I know about computers right now.

Here's what I would like to build: a hypervisor that runs unikernels in "slots." Each unikernel is allocated one or more disk images; each kernel is fully isolated from the others and uses a capability system to assist in enforcing this. A unikernel would technically take up two slots: the primary slot and a shadow slot. The shadow slot would be used for blue-green transitions; since the file system is a disk image, it would be easy to COW or otherwise snapshot, and the new code can pick it up right away. The hypervisor would signal the primary kernel that it's being transitioned; this should trigger it to stop accepting new connections and shutdown gracefully. Meanwhile, the shadow slot has taken over serving and the slot roles are reversed. Until an update is uploaded to the shadow slot, the previous version will remain in place so that a rollback can be conducted if needed. Program storage is separate from disk storage, so that both slots can share the same disk image if needed. The unikernel idea mitiages many threat vectors; for example, you can't pop a shell if there's no shell to be popped. If the kernel dies, the hypervisor can just restart it; this would be a policy choice on the part of the OS.