Skip to content

Commit 47bfef7

Browse files
congwang-mkclaude
congwang-mk
and
claude
committed
Improve FAQ page: add categories, nested virtualization Q&A, remove inline styles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 9f61dfa commit 47bfef7

2 files changed

Lines changed: 136 additions & 143 deletions

File tree

‎assets/css/faq.css‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,13 +55,26 @@
5555
.faq-answer a {
5656
color: var(--gray-900);
5757
text-decoration: underline;
58-
text-decoration-color: var(--primary-200);
58+
text-decoration-color: var(--gray-300);
5959
text-underline-offset: 2px;
6060
}
6161

6262
.faq-answer a:hover {
6363
color: var(--gray-700);
64-
text-decoration-color: var(--primary-400);
64+
text-decoration-color: var(--gray-500);
65+
}
66+
67+
.faq-category {
68+
font-family: var(--font-display);
69+
font-size: var(--text-xl);
70+
font-weight: 700;
71+
color: var(--gray-900);
72+
margin: var(--space-10) 0 var(--space-5) 0;
73+
letter-spacing: -0.01em;
74+
}
75+
76+
.faq-category:first-of-type {
77+
margin-top: 0;
6578
}
6679

6780
.faq-content i {

‎faq.html‎

Lines changed: 121 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -4,154 +4,134 @@
44
permalink: /faq.html
55
---
66

7-
<style>
8-
.faq-content .faq-item {
9-
margin-bottom: 2.5rem;
10-
padding-bottom: 2rem;
11-
border-bottom: 1px solid #e0e0e0;
12-
}
13-
14-
.faq-content .faq-item:last-child {
15-
border-bottom: none;
16-
margin-bottom: 0;
17-
padding-bottom: 0;
18-
}
19-
20-
.faq-content .faq-question {
21-
font-size: 1.25rem;
22-
font-weight: 600;
23-
color: #333;
24-
margin-bottom: 1rem;
25-
display: flex;
26-
align-items: center;
27-
gap: 0.75rem;
28-
}
29-
30-
.faq-content .faq-answer {
31-
font-size: 1.1rem;
32-
line-height: 1.7;
33-
color: #555;
34-
margin: 0;
35-
text-align: left;
36-
max-width: 100%;
37-
}
38-
39-
.faq-content i {
40-
width: 20px;
41-
height: 20px;
42-
flex-shrink: 0;
43-
color: #007bff;
44-
}
45-
</style>
46-
47-
<main style="margin-top: 0; padding-top: 0;">
7+
<main>
488
<section class="hero">
499
<div class="hero-container">
5010
<h1>Frequently Asked Questions</h1>
51-
<p>Common questions about multikernel technology, architecture, and implementation.</p>
11+
<p class="subtitle">Common questions about multikernel technology, architecture, and implementation.</p>
5212
</div>
5313
</section>
5414

55-
<section class="info">
56-
<div class="container">
57-
<div class="faq-content">
58-
<div class="faq-item">
59-
<div class="faq-question">
60-
<i data-lucide="info"></i> What is multikernel anyway?
61-
</div>
62-
<p class="faq-answer">Multikernel is an architecture that runs multiple kernels in parallel without relying on virtualization. Unlike the <a href="https://www.sigops.org/s/conferences/sosp/2009/papers/baumann-sosp09.pdf" target="_blank" rel="noopener noreferrer">original academic definition</a> which treats machines as distributed systems with message-passing cores, our implementation focuses on practical kernel isolation and performance optimization.</p>
63-
</div>
64-
65-
<div class="faq-item">
66-
<div class="faq-question">
67-
<i data-lucide="help-circle"></i> How does multikernel differ from containers and VMs?
68-
</div>
69-
<p class="faq-answer">Unlike containers that share a kernel or VMs that add virtualization overhead, our multikernel architecture provides true kernel isolation with near bare-metal performance, dynamic resource allocation, and application-optimized environments.</p>
70-
</div>
71-
72-
<div class="faq-item">
73-
<div class="faq-question">
74-
<i data-lucide="cpu"></i> What types of workloads benefit most from multikernel?
75-
</div>
76-
<p class="faq-answer">High-performance computing, AI/ML frameworks, latency-sensitive services, and applications with strict security requirements gain the most advantage from our multikernel architecture.</p>
77-
</div>
78-
79-
<div class="faq-item">
80-
<div class="faq-question">
81-
<i data-lucide="layers"></i> Does multikernel work with existing infrastructure?
82-
</div>
83-
<p class="faq-answer">Yes, our solution is designed to integrate with standard cloud and on-premises infrastructure, providing a seamless transition path from traditional virtualization or container environments.</p>
84-
</div>
85-
86-
<div class="faq-item">
87-
<div class="faq-question">
88-
<i data-lucide="check-circle"></i> Is multikernel compatible with existing Linux applications?
89-
</div>
90-
<p class="faq-answer">Absolutely. Multikernel maintains 100% compatibility with existing Linux applications and system interfaces. Our implementation introduces only minimal, non-intrusive kernel modifications that preserve full API and ABI compatibility, ensuring your applications run unchanged without any modifications or performance degradation.</p>
91-
</div>
92-
93-
<div class="faq-item">
94-
<div class="faq-question">
95-
<i data-lucide="zap"></i> Why not use unikernels instead?
96-
</div>
97-
<p class="faq-answer">While unikernels eliminate syscall overhead, modern CPUs already provide highly optimized syscall performance, making this benefit marginal. Most unikernels still rely on virtualization layers, inheriting their performance penalties. Like unikernels, multikernel avoids a full OS by running applications and their necessary dependencies directly in initramfs, but delivers superior isolation and performance without virtualization overhead or the complexity of rebuilding applications for specialized kernel environments.</p>
98-
</div>
99-
100-
<div class="faq-item">
101-
<div class="faq-question">
102-
<i data-lucide="git-branch"></i> What's the difference with Jailhouse?
103-
</div>
104-
<p class="faq-answer"><a href="https://github.com/siemens/jailhouse" target="_blank" rel="noopener noreferrer">Jailhouse</a> only supports static partitioning, while multikernel provides dynamic resource allocation essential for modern cloud computing. Additionally, Jailhouse relies on traditional virtualization mechanisms like VMEXIT and SR-IOV. Multikernel avoids virtualization overhead entirely while maintaining compatibility with existing virtualization technologies when needed.</p>
105-
</div>
106-
107-
<div class="faq-item">
108-
<div class="faq-question">
109-
<i data-lucide="shuffle"></i> Why not static partitioning?
110-
</div>
111-
<p class="faq-answer">Dynamic resource allocation is essential for modern cloud computing. Static partitioning can be achieved as a special case of dynamic allocation when resources remain unchanged, but the reverse is not possible.</p>
112-
</div>
113-
114-
<div class="faq-item">
115-
<div class="faq-question">
116-
<i data-lucide="minus-circle"></i> Why not Directvisor or de-virtualization?
117-
</div>
118-
<p class="faq-answer"><a href="https://dl.acm.org/doi/10.1145/3381052.3381317" target="_blank" rel="noopener noreferrer">Directvisor</a> and similar de-virtualization approaches still fundamentally rely on virtualization infrastructure. From our perspective, virtualization followed by de-virtualization equals no virtualization—making it more efficient to eliminate virtualization layers entirely from the start rather than adding complexity to remove them later.</p>
119-
</div>
120-
121-
<div class="faq-item">
122-
<div class="faq-question">
123-
<i data-lucide="activity"></i> Does SR-IOV eliminate virtualization overhead?
124-
</div>
125-
<p class="faq-answer">No. While SR-IOV and hardware acceleration significantly reduce virtualization overhead, they cannot eliminate it entirely. VM exits, IOMMU translations, and hypervisor intervention for privileged operations still introduce measurable latency and CPU cycles. Multikernel bypasses these virtualization layers intentionally and completely, achieving near bare-metal performance without hardware acceleration dependencies.</p>
126-
</div>
127-
128-
<div class="faq-item">
129-
<div class="faq-question">
130-
<i data-lucide="settings"></i> What's wrong with SR-IOV?
131-
</div>
132-
<p class="faq-answer">Nothing is inherently wrong with SR-IOV—it's actually quite fast, and IOMMU overhead can be minimal when properly configured. However, VFs provide coarse-grained isolation mechanisms. Multikernel leverages hardware queues as more flexible and elastic resources, offering finer granularity and dynamic resource allocation compared to the static nature of VFs.</p>
133-
</div>
134-
135-
<div class="faq-item">
136-
<div class="faq-question">
137-
<i data-lucide="hard-drive"></i> Do multikernels share hardware resources?
138-
</div>
139-
<p class="faq-answer">No. Multikernels receive dedicated physical CPU cores without kernel context switching, leveraging the abundance of cores in modern servers (typically 256+ cores). For I/O hardware, we utilize hardware queues as more flexible and elastic resources for exclusive per-kernel allocation.</p>
140-
</div>
141-
142-
<div class="faq-item">
143-
<div class="faq-question">
144-
<i data-lucide="shield"></i> How does multikernel enhance security?
145-
</div>
146-
<p class="faq-answer">Our architecture provides hardware-enforced isolation between workloads, minimizes attack surfaces through tailored kernels, and offers enhanced confidential computing capabilities for sensitive data processing. By avoiding a full OS and running applications directly in initramfs, we further reduce the attack surface compared to traditional operating systems.</p>
147-
</div>
148-
149-
<div class="faq-item">
150-
<div class="faq-question">
151-
<i data-lucide="lock"></i> What is the trust model of multikernel?
152-
</div>
153-
<p class="faq-answer">Multikernel relies on kernel-enforced isolation, making the kernel itself the trust boundary. While a malicious kernel could potentially disrupt other kernels on the same node, this risk can be mitigated through kernel signing via kexec, kernel lockdown, and memory encryption using confidential computing technologies.</p>
15+
<section class="content-page">
16+
<div class="faq-content">
17+
18+
<!-- Overview -->
19+
<h2 class="faq-category">Overview</h2>
20+
21+
<div class="faq-item">
22+
<div class="faq-question">
23+
<i data-lucide="info"></i> What is multikernel?
24+
</div>
25+
<p class="faq-answer">Multikernel is an architecture that runs multiple kernels in parallel without relying on virtualization. Unlike the <a href="https://www.sigops.org/s/conferences/sosp/2009/papers/baumann-sosp09.pdf" target="_blank" rel="noopener noreferrer">original academic definition</a> which treats machines as distributed systems with message-passing cores, our implementation focuses on practical kernel isolation and performance optimization.</p>
26+
</div>
27+
28+
<div class="faq-item">
29+
<div class="faq-question">
30+
<i data-lucide="help-circle"></i> How does multikernel differ from containers and VMs?
31+
</div>
32+
<p class="faq-answer">Containers share a single kernel, which limits isolation. VMs provide isolation but add virtualization overhead. Multikernel provides true kernel-level isolation with near bare-metal performance and dynamic resource allocation, without the overhead of a hypervisor.</p>
33+
</div>
34+
35+
<div class="faq-item">
36+
<div class="faq-question">
37+
<i data-lucide="cpu"></i> What types of workloads benefit most?
38+
</div>
39+
<p class="faq-answer">High-performance computing, AI/ML training and inference, latency-sensitive services, and workloads with strict security or isolation requirements gain the most from multikernel architecture.</p>
40+
</div>
41+
42+
<div class="faq-item">
43+
<div class="faq-question">
44+
<i data-lucide="check-circle"></i> Is multikernel compatible with existing Linux applications?
45+
</div>
46+
<p class="faq-answer">Yes. Multikernel maintains full compatibility with existing Linux applications and system interfaces. Our implementation introduces only minimal, non-intrusive kernel modifications that preserve complete API and ABI compatibility. Your applications run unchanged.</p>
47+
</div>
48+
49+
<div class="faq-item">
50+
<div class="faq-question">
51+
<i data-lucide="layers"></i> Does multikernel work with existing infrastructure?
52+
</div>
53+
<p class="faq-answer">Yes. Multikernel integrates with standard cloud and on-premises infrastructure, providing a practical migration path from traditional virtualization or container environments.</p>
15454
</div>
55+
56+
<!-- Architecture & Design -->
57+
<h2 class="faq-category">Architecture & Design</h2>
58+
59+
<div class="faq-item">
60+
<div class="faq-question">
61+
<i data-lucide="hard-drive"></i> How does the split-kernel architecture handle hardware resources?
62+
</div>
63+
<p class="faq-answer">In our split-kernel architecture, the host kernel manages hardware and device processing, while application kernels run workloads with dedicated CPU cores and no kernel context switching. Hardware resources like I/O queues are allocated exclusively to each application kernel by the host kernel, providing both strong isolation and near bare-metal performance. Modern servers with 256+ cores make this dedicated allocation practical at scale.</p>
64+
</div>
65+
66+
<div class="faq-item">
67+
<div class="faq-question">
68+
<i data-lucide="shuffle"></i> Why dynamic resource allocation instead of static partitioning?
69+
</div>
70+
<p class="faq-answer">Modern cloud workloads require elasticity. Static partitioning can be achieved as a special case of dynamic allocation when resources remain unchanged, but the reverse is not possible. Dynamic allocation is essential for efficient resource utilization at scale.</p>
71+
</div>
72+
73+
<!-- Comparisons -->
74+
<h2 class="faq-category">How We Compare</h2>
75+
76+
<div class="faq-item">
77+
<div class="faq-question">
78+
<i data-lucide="zap"></i> Why not use unikernels?
79+
</div>
80+
<p class="faq-answer">Unikernels eliminate syscall overhead, but modern CPUs already provide highly optimized syscall performance, making this benefit marginal. Most unikernels still rely on virtualization layers, inheriting their performance penalties. Multikernel delivers superior isolation and performance without virtualization overhead or the need to rebuild applications for specialized kernel environments.</p>
81+
</div>
82+
83+
<div class="faq-item">
84+
<div class="faq-question">
85+
<i data-lucide="git-branch"></i> What is the difference from Jailhouse?
86+
</div>
87+
<p class="faq-answer"><a href="https://github.com/siemens/jailhouse" target="_blank" rel="noopener noreferrer">Jailhouse</a> only supports static partitioning and relies on traditional virtualization mechanisms like VMEXIT and SR-IOV. Multikernel provides dynamic resource allocation and avoids virtualization overhead entirely while maintaining compatibility with existing virtualization technologies when needed.</p>
88+
</div>
89+
90+
<div class="faq-item">
91+
<div class="faq-question">
92+
<i data-lucide="minus-circle"></i> Why not Directvisor or de-virtualization?
93+
</div>
94+
<p class="faq-answer"><a href="https://dl.acm.org/doi/10.1145/3381052.3381317" target="_blank" rel="noopener noreferrer">Directvisor</a> and similar de-virtualization approaches still fundamentally rely on virtualization infrastructure. Virtualization followed by de-virtualization equals no virtualization, making it more efficient to eliminate virtualization layers entirely from the start.</p>
95+
</div>
96+
97+
<div class="faq-item">
98+
<div class="faq-question">
99+
<i data-lucide="box"></i> Is nested virtualization a real problem?
100+
</div>
101+
<p class="faq-answer">Yes, and it is more common than many realize. Cloud providers run VMs for tenants, and those tenants often run their own VMs or containers with hypervisor-based isolation inside. Kubernetes nodes on cloud instances, CI/CD pipelines spinning up VMs, and security sandboxes all create nested virtualization in practice. Each layer multiplies overhead: additional VM exits, shadow page tables, and emulated I/O compound latency significantly. Multikernel eliminates this problem entirely by providing kernel-level isolation without any hypervisor, removing the need to nest virtualization layers in the first place.</p>
102+
</div>
103+
104+
<div class="faq-item">
105+
<div class="faq-question">
106+
<i data-lucide="activity"></i> Does SR-IOV eliminate virtualization overhead?
107+
</div>
108+
<p class="faq-answer">No. While SR-IOV and hardware acceleration significantly reduce virtualization overhead, they cannot eliminate it entirely. VM exits, IOMMU translations, and hypervisor intervention for privileged operations still introduce measurable latency. Multikernel bypasses these virtualization layers completely, achieving near bare-metal performance without hardware acceleration dependencies.</p>
109+
</div>
110+
111+
<div class="faq-item">
112+
<div class="faq-question">
113+
<i data-lucide="settings"></i> What about SR-IOV for I/O?
114+
</div>
115+
<p class="faq-answer">SR-IOV is fast and IOMMU overhead can be minimal when properly configured. However, VFs provide coarse-grained isolation mechanisms. Multikernel leverages hardware queues as more flexible and elastic resources, offering finer granularity and dynamic resource allocation compared to the static nature of VFs.</p>
116+
</div>
117+
118+
<!-- Security -->
119+
<h2 class="faq-category">Security & Trust</h2>
120+
121+
<div class="faq-item">
122+
<div class="faq-question">
123+
<i data-lucide="shield"></i> How does multikernel enhance security?
124+
</div>
125+
<p class="faq-answer">Our architecture provides hardware-enforced isolation between workloads, minimizes attack surfaces through tailored kernels, and supports confidential computing for sensitive data processing. By running applications directly in initramfs without a full OS, we further reduce the attack surface compared to traditional environments.</p>
126+
</div>
127+
128+
<div class="faq-item">
129+
<div class="faq-question">
130+
<i data-lucide="lock"></i> What is the trust model?
131+
</div>
132+
<p class="faq-answer">The kernel itself is the trust boundary. While a compromised kernel could potentially affect other kernels on the same node, this risk is mitigated through kernel signing via kexec, kernel lockdown, and memory encryption using confidential computing technologies.</p>
133+
</div>
134+
155135
</div>
156136
</section>
157137
</main>

0 commit comments

Comments
 (0)