Tailor-Made Security: Building a Kubernetes Specific Hypervisor
summary
Argues for a Kubernetes-targeted VMM built from rust-vmm crates to avoid QEMU’s ~1.5M LOC bulk while offering more than Firecracker’s ~20–30K LOC narrow scope. Maps CRI requirements to concrete tech: virtio/virtio‑fs or 9p shared storage, KVM/VFIO device pass‑through for GPUs and direct I/O, and ACPI/PCI mechanisms for CPU/memory hotplug. Demonstrates glue code pattern, a rate‑limit crate for multi‑tenant QoS, and a minimal kernel loader to run full CRI workloads inside lightweight, container‑focused VMMs.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:08Linux Virtualization Stack
- 10:16Firecracker
- 12:36What defines a container?
- 16:31From Requirements to Technologies
- 24:34From idea to published crate
- 27:23Current Status
- 29:55Serverless
- 31:09What's next?
- 32:58Conclusion
related talks
38mImproving your Kubernetes Workload Security
32mLotsa security - confining the extra security layer
12mSecurity and Performance in the Delegated User-level Virtualization
44mSecure isolation in Rust
14mA kernel? In a Container? Explain Yourself!
15mKeynote: Virtualization Reimagined
27mVMs in a container-centric world
47mContainer Security