Container Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 11:00· Level 1 | Hall Entrance S10 | Room D·
summary
Compares concrete runtimes (runc, crun, containerd, gVisor, Kata, Firecracker, WASM/WoM) and shows tradeoffs: gVisor intercepts syscalls to shrink attack surface, microVMs (Firecracker/Kata) give VM-level isolation at measurable CPU/memory/latency cost, and runc CVE examples show real breakout risk. Presents performance benchmarks (lower start times for crun, higher overhead for VM approaches), introduces a terminal tool for reporting isolation level and announces Adera Protect 1.0 GA as a lightweight zone-based kernel approach that is already runnable.
AI-written summary · about
chapters (11)
- 0:00Container isolation challenges
- 3:08Container runtimes and risks
- 10:13Runtime classes by isolation
- 12:38History of container isolation
- 17:13Popular runtimes compared
- 22:45Isolation breaking and risks
- 24:11Multi-tenancy isolation strategies
- 27:47Costs of secure isolation
- 30:19Choosing isolation level
- 31:42Tooling for isolation levels
- 32:03Conclusion and advice
related talks
31mYour Containers Aren’t Alone: Demystifying Container Isolation
14mYour Containers Aren’t Alone: Demystifying Container Isolation
27mVMs in a container-centric world
25mYou Can’t Handle the Root! Container Isolation...
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
45mSecuring Container Runtimes -- How Hard Can It Be?
53mFrom Secure Container to Secure Service
26mConfidential Containers with the Crun-Krun Container Runtime