Hillingar - MirageOS Unikernels on NixOS
A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.
This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.
- Details building MirageOS OCaml unikernels with Nix for reproducible deployment on NixOS hosts.
- Unikernels enable dead-code elimination, shrinking attack surface versus traditional VM appliance stacks.
- Demonstrates an authoritative DNS server deployment with a custom NixOS module.
- Addresses opam dependency version-constraint solving when linking a single dependency set.
From the original article
14 min read at ryan.freumh.orgcomponent of the modern Internet, allowing domain names to be mapped to IP addresses, mailservers, and more 1 . This allows users to access services independent of their location in the Internet using
By ryan.freumh.org via sjamaan · ryan.freumh.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.