Three New Ways to Boot a Unikernel and One Very Good Reason to Upgrade

urunc v0.8.0 just shipped, and it is a big one: a third way to boot a unikernel, two new unikernel targets, faster networking, a rootless mode that finally behaves, and two critical security advisories closed.

First, the basics. urunc is a container runtime for unikernels — tiny, single-purpose operating systems compiled into one lean image together with the application. The project describes itself as a simple container runtime that aspires to become runc for unikernels. In other words: it wants your weird little single-purpose OS to be treated exactly like any other container.

Why does that matter? A unikernel is a vending machine: one dish, no kitchen, no waiter, and it does that one thing brilliantly. A container platform is a food court: standard counters, standard power, and every tool you own already knows how to work with it. urunc is the adapter that lets your vending machine rent a stall in the food court.

To containerd, Docker, nerdctl (containerd’s docker-like CLI), podman, and Kubernetes, a unikernel looks like just another container. Behind the counter, urunc boots it on a real virtual machine monitor.

Your single-purpose operating system, ordering off the same menu as every other container.

Who uses this? Platform teams and researchers chasing small footprints and a minimal attack surface, usually with unikernel frameworks like Unikraft and MirageOS.

And why should you care about v0.8.0 specifically? Because it adds three new ways to boot a unikernel: one new sandbox monitor (in urunc-speak, the small hypervisor layer that actually runs your unikernel) plus two new unikernel targets. It also makes the networking faster, runs nicely without root — and if you are on 0.7.0 or older, it fixes two critical security holes that an external reporter found in the annotations path. Let us walk through it.

What Is New in urunc v0.8.0

Cloud Hypervisor Joins the Menu

Cloud Hypervisor is a modern virtual machine monitor written in Rust, and it is now a supported sandbox monitor option in urunc, right next to QEMU and Firecracker. Why care? Because monitors are a matter of tradeoffs: QEMU is the universal one, Firecracker is the lean microVM one (a stripped-down, minimal VM), and Cloud Hypervisor is the Rust-based one. More monitors means you get to pick your favorite mix of boot speed, footprint, and features instead of settling for whatever the runtime hands you.

On the Kubernetes side, nothing exotic is required — the usual runtime class does the trick:

spec:
  runtimeClassName: urunc
  containers:
  - image: harbor.nbfc.io/nubificus/urunc/busybox-cloud-hypervisor-linux-raw:latest
    args: ["ip", "a"]

That image boots a BusyBox unikernel on Cloud Hypervisor, through urunc, straight from a pod spec. Shipped in PR #393.

Hermit and hyperlight-unikraft Walk In

Two new unikernel targets arrived, and they could not be more different. Hermit is a unikernel that runs over QEMU on amd64. hyperlight-unikraft is the wild one: instead of spawning an external virtual machine process like QEMU or Firecracker, it embeds the VMM inside the runtime itself and executes the unikernel directly. That is a genuinely different architecture — no external process orchestration, just one process doing everything.

Honesty corner, because the release notes are refreshingly honest about it too: both are initial support, simple execution only. No networking, no mounts on these two yet. Think of them as a preview of the direction, not your Monday-morning production path.

sudo nerdctl run --rm -ti --runtime io.containerd.urunc.v2 jimjuniorb/hermit-qemu-hello-world:latest

Hermit support landed in PR #540, and the embedded hyperlight VMM (virtual machine monitor — same animal as urunc’s other sandbox monitors) in PR #632.

Faster Networking and a Rootless Mode That Behaves

Three quality-of-life upgrades that together make urunc feel far more production-shaped.

vhost for QEMU — virtio is the virtual-network-device standard QEMU speaks, and vhost moves its packet processing into the kernel. That is a polite way of saying your network gets faster without changing anything about your containers.

MTU auto-detection: urunc now reads the MTU — the maximum packet size — from the host-side veth interface, the container’s network cable. It applies that value to the tap device, the virtual plug the unikernel gets, so your unikernel’s network interface finally agrees with the network it is actually plugged into — no more silent mismatches on clusters that do not use the default MTU.

Rootless mode — the story here: urunc now honors XDG_RUNTIME_DIR for its default runtime root when running unprivileged, exactly like runc does (runc being the standard low-level container runtime underneath Docker and containerd), and it bind-mounts device nodes instead of trying to create them when running inside a user namespace. Translation: you can run unikernels as a regular user through podman, no root required. One prerequisite: urunc needs to know where your QEMU binary lives, so give it a two-line /etc/urunc/config.toml first:

[monitors.qemu]
path = "/usr/bin/qemu-system-x86_64"

Then boot a unikernel as yourself:

podman run --rm -d --runtime urunc \
  harbor.nbfc.io/nubificus/urunc/nginx-qemu-unikraft-initrd:latest

Note the naming difference: containerd tools like nerdctl want the full runtime name io.containerd.urunc.v2, while podman just wants urunc. Both are correct.

vhost arrived in PR #415, the MTU fix in PR #564, rootless runtime root in PR #465, and device bind-mounting in PR #510.

Small Knobs That Make Ops Humans Happy

The unglamorous changes that save your evening:

• ps --format json — urunc now answers the process query containerd sends during recovery. Restart containerd and your unikernel containers survive it instead of being flagged as leaked. Honest, boring, essential. (PR #601)
• Real signals in urunc kill — the kill command used to always send SIGKILL, no matter what you asked for. Now it forwards the signal you actually chose. (PR #612)
• URUNC_CONFIG_FILE — the configuration file path can now be overridden, which is great news on immutable hosts like Talos where /etc is read-only. (PR #989)
• libcontainer-built monitor environments — an experimental, opt-in path that uses runc’s libcontainer to set up the monitor’s namespaces, cgroups, and mounts. Off by default, but a promising convergence with the runc ecosystem. (PR #982)

Two Critical Security Advisories, Both Fixed Here

This is the part where existing users should stop scrolling. Both issues come from the same root cause: image and pod annotations were trusted too much. Annotations are the key-value metadata labels that ship with a container image or pod and tell urunc how to boot the unikernel — which binary, which initrd, which devices. Trust those blindly, and a hostile image starts steering the runtime.

• Argument injection — annotation values were concatenated into the sandbox monitor’s command line and then split on spaces, so a carefully crafted image could smuggle extra command-line arguments into the monitor. (GHSA-crxr-jm9v-349c)
• Path traversal — annotations that control which files get bind-mounted could be pointed at arbitrary host files, letting a malicious image read, modify, or corrupt them. (GHSA-3385-hmpj-4678)

Both are rated critical by the project, affect all versions up to and including 0.7.0, and are patched in 0.8.0. If you run untrusted images, or let users create pods with their own annotations on a urunc cluster, upgrade first and read the advisories after. Credit where due: Sergey Kaniborov (@r0binak) of Luntry found and responsibly disclosed both.

Breaking Changes to Plan Around

• New install layout — urunc-deploy, the containerized installer, now installs everything under /opt/urunc with its config at /etc/urunc/config.toml. (PR #387)
• PID file behavior — the monitor’s PID is now written to the runtime-provided --pid-file after container creation.
• Deprecated annotation — com.urunc.unikernel.cmdline is deprecated; application arguments come from the OCI process spec (the standard container run description) — as they have since v0.7.0; the old annotation path is what is being removed. (PR #1017)
• Separate rootfs — the rootfs is the filesystem a process boots from. The container’s rootfs and the monitor’s rootfs are no longer shared, so check any setup that assumed they overlapped before upgrading.
• vAccel off by default — vAccel is the GPU-acceleration framework urunc can integrate with; enable it from the urunc configuration if you need it.

urunc v0.8.0 is the release where the unikernel vending machine starts paying rent — three new boot paths, a rootless mode, honest security fixes, and every reason to upgrade.

Learn More

• urunc Official Website
• GitHub Repository
• Full Changelog for v0.8.0