Hmm, but there could still be a libraries that take care of the common tasks: how to talk to an SSH client, how to get some basic info from the Mirage kernel, etc. Since these unikernels are so specialized maybe SSH would be overkill, but I wouldn't want each developer to invent their own potentially insecure way of communicating with the unikernels.

We've got an SSHv2 client/server in pure OCaml already, but are waiting for the OCaml TLS effort to be integrated before putting the SSH layer in. It will be use the toplevel libraries and be optional...