nanos-unveil

OpenBSD-style unveil syscall to restrict filesystem view on a Nanos unikernel