And maybe a good new now!
With the comment at qubes-core-admin/__init__.py at 8e0de909c1defa5b979aac8f28449cd07cad1720 · QubesOS/qubes-core-admin · GitHub it seems that if we never report free memory we are out of the ballooning process (maybe the check/uncheck property in qubes-manager has to be handled by the AppVM kernel?).
So I tried to remove the memory reporting to Xen to force the unikernel to be not counted as donor. I have no more that issue now.
If anyone want to also try out and confirm it works before I PR it, you can run:
# install opam > 2.1
bash -c "sh <(curl -fsSL https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh)"
# install mirage
opam init
opam install mirage
eval $(opam env)
# clone and compile mirage-fw
git clone https://github.com/palainp/qubes-mirage-firewall
git checkout test-no-mem-report
mirage configure -t xen && make depend && dune build
then copy dist/qubes-firewall.xen to dom0.