You Can’t Handle the Root! Container Isolation...
summary
Container isolation is a spectrum of concrete tradeoffs and tools: kernel features like namespaces, cgroups, seccomp give strong baseline protection with zero extra hardware; user‑space runtimes such as gVisor and Firecracker or microVM stacks (KVM/Xen + Firecracker/Cloud Hypervisor + Kata) replace a shared kernel and can run hundreds to thousands of microVMs per host; hardware options like TEEs encrypt memory but limit instances; GPU isolation ranges from NVIDIA MPS to time‑sharing (vGPU/GVTg) to hardware partitioning MIG and MxGPU and PCI‑passthrough, each changing compatibility, performance, and cost.
AI-written summary · about
chapters (8)
- 0:00Container isolation challenges
- 3:13Container isolation for security
- 7:28Isolation mechanisms
- 10:21Runtime isolation with VMs
- 15:12Node isolation design
- 15:56Hardware isolation
- 18:01GPU isolation for AI
- 23:51Call to action
related talks
31mYour Containers Aren’t Alone: Demystifying Container Isolation
14mYour Containers Aren’t Alone: Demystifying Container Isolation
47mContainer Security
29mLayers of Isolation in Kubernetes
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
19mSandbox to confidential containers: A brief on the evolution of container isolation
22mSandboxes all the way down - A hitchhiker's guide to platform...
14mA kernel? In a Container? Explain Yourself!