uIO: Lightweight and Extensible Unikernels

Unikernels specialize the OS for a single application at compile time, yielding small images with fast boot, better performance, and a smaller trusted computing base, but they lack the run-time extensibility needed for on-demand auxiliary tasks such as debugging, monitoring, reconfiguration, and management. This creates a fundamental trade-off between compile-time image slimness and run-time flexibility. uIO resolves this with a "safe overlay" abstraction that keeps the base image minimal while adding on-demand extensibility: using a generic VirtIO-based interface, users load and run external programs in the unikernel's address space through a file-system interface, with safe execution enforced via hardware-assisted memory isolation (MPK) and language-runtime-based isolation.