Host File System Access

[Harry-R]

uhyve grants full host file system access from within the unikernel with the permissions of the user running uhyve. Thus, a malicious or compromised unikernel (application) could compromise the host system.
As one of the advertised security aspects of unikernels is their strong isolation against the host system and other unikernels, this is nothing one would expect from a hypervisor designed for a unikernel.
One possible solution would be to allow access only to a certain shared folder of which the path can be passed to uhyve on startup.
However, until this is fixed (or if the full host file system access is considered a feature and not a bug) it should be properly documented in the README file.

[stlankes]

You are right, we should describe a solution to avoid full filesystem access. In the future, runh is used to limit file system access. But here is also a description missing.