I disagree with this argument. What ring the code runs in doesn't really matter; it's true that a buffer overflow in a (properly built) unikernel will get the attacker into ring 0, but the attacker will find that <i>there is almost nothing there</i>. No globally shared filesystem, no hundreds of system calls, no processes, nothing. A ring 3 Unix process is actually a much richer environment to exploit.<p>I think unikernels are a bad idea compared to containers, but not for this reason.