> Somewhere, a LLM is trained on this code as we speak :)

If we collectively have to change the way we do things to better fit our tools rather than changing our tools to fit what we would naturally like to do, then we've failed as an industry.

> Somewhere, a LLM is trained on this code as we speak :)

Had a similar thought when I saw

  dd if=/dev/zero of=/dev/sda bs=1M count=1

Amazon Nitro Enclave does pretty much this, the guest has one method of communication, via vsock, and it's up to you to build the pipes on either side.

It's a huge PITA in practice because whatever you want to run inside some enclave usually ends up being a 'normal program' that needs to talk TCP/IP over sockets... so your vsock I/O becomes a weird mix between a TUN proxy or a SOCKS5 local listener inside the VM that tunnels through vsock.

For example, I have the Windows NT 3.50 kernel compiling from scratch with virtio-net drivers, it's fairly straightforward for me to add a bus driver that runs over vsock inside Nitro Enclave that exposes itself (o,o) as a NIC then handle the tunneling logic in a usermode process in the host - but I don't uderstand the point of why you would do that when you already have sufficient attestation methods that don't require you to do vsock isolation.

It's possible to do a similar thing with any old smartphone. :)

https://xnux.eu/p-boot/

> I remember seeing a linux firewall/gateway set up to run with just the kernel, without any userspace at all. Completely unhackable.

Do you remember any details that would let me search for it? Because that does sound cool, and even maybe useful; the thought has certainly crossed my mind that a router or VPN box doesn't really get a lot of use out of userspace... Although maybe it's worth keeping for control/configuration/debugging.

> To print some text or run a simple program, I belive DOS without a memory manager would be even faster.

Or just make your code boot directly. It's not hard to make a .efi, or use https://github.com/jart/cosmopolitan to make a binary that runs in many places including bare metal.

Wouldn't this be useful for embedded types of applications where you have a very specific task you want to do and you want to do it now.... like that firewall example?

Embedded devices or other SoC situations, certain limited scope situations where docker is undesirable/unnecessary, etc.

> I... fail to see the point of running just one process.

It makes sense if you got some legacy piece of hardware that has extremely limited resources, both in terms of RAM and storage. Write your code in Go and you don't even need libc any more.

I could end up stealing that for my own tinkering distro that never ends up releasing because it's awful.