MirageOS + dune

config.ml

open Mirage

let disk = generic_kv_ro "t"

let main = foreign "Unikernel.Main" (kv_ro @-> job)

let () = register ~reporter:Mirage.no_reporter "kv_ro" [ main $ disk ]

dune

; should be compiled first
(executable
 (name config)
 (modules config)
 (libraries mirage))

; mirage configure
(rule
 (targets key_gen.ml main.ml Makefile .mirage.config) ; the list of targets is dynamic (1)
 (action
  (run ./config.exe configure)))

; mirage build
(rule
 (targets static.ml static.mli) ; the list of targets is dynamic (2)
 (deps
  .mirage.config
  (source_tree t)) ; the list of deps depends on what is in config.ml but (source_tree .) could work too
 (action
  (run ./config.exe build)))

; mirage run
(test
 (name main)
 (package mirage)
 (modules unikernel key_gen main static oS) ; the list of modules is dynamic ((1)+(2))
 (libraries mirage mirage-kv lwt.unix mirage-kv-mem mirage-bootvar-unix)) ; the list of libraries is dynamic

main.expected

Contents of extremely secret vital storage confirmed!

t---b

bar

t---secret

foo

unikernel.ml

open Lwt.Infix

let log fmt = Fmt.pr (fmt ^^ "\n%!")

module Main (KV : Mirage_kv.RO) = struct
  let start kv =
    let our_secret = "foo\n" in
    KV.get kv (Mirage_kv.Key.v "secret") >|= function
    | Error e ->
        log "Could not compare the secret against a known constant: %a"
          KV.pp_error e
    | Ok stored_secret -> (
        match String.compare our_secret stored_secret with
        | 0 -> log "Contents of extremely secret vital storage confirmed!"
        | _ -> log "The secret provided does not match!" )
end