OSv the library operating system

Glauber Costa (lead developer at Cloudius-Systems). OSv has smaller attack-surface size than linux.

seL4 vs OSv

Security enhanced micro kernel seL4. seL4 is incomplete and only secures the kernel layer. OSv lets you package safe containers for your apps. "If I run seL4, is my system secure? Not automatically, no. Security is a question that spans the whole system, including its human parts. An OS kernel, verified or not, does not automatically make a system secure. In fact, any system, no matter how secure, can be used in insecure ways. "

OSv is a library-operating-system, and allows you to custom code your Zero-Trust network policies directly into each VM instance, there are no runtime configuration files to worry about, security policies can be compiled into the kernel.

Zero Trust

In the USENIX presentation above, Nadav Har’El talks about the performance advantages of OSv, but completely forgets to mention the security advantages that OSv offers. Performance optimizations can quickly become a distraction. The most important issue is security, and OSv fits particularly well into the zero-trust internal network model. OSv allows programmer to package their applications into VM images that can be easily deployed to the cloud. With OSv there is less reliance on system administrators to manage the security of the cloud deployment, and therefore less people that need privileged trusted access within the network.

no tuning no state and no patching

Kivity and Costa give a great overview of OSv, its superior performance and security at LinuxCon2013. They explain how system administration is greatly simplified by using VM image containers. OSv potentially provides the most secure system platform, by allowing developers to better integrate with a zero-trust internal network, and depend less on system administrators for security. (skip ahead to 27minutes to see the part on security)