From Secure Container to Secure Service
summary
Compares secure container runtimes—Kata Containers (with lightweight hypervisors NEMU and Firecracker, virtio-fs for filesystem sharing, and containerd shimv2 integration) and gVisor—focusing on performance trade-offs (CPU, networking, filesystem, memory, syscall overhead). Describes Ant Financial’s engineering that combines those secure sandboxed containers with a Service Mesh layer to build a broader secure service solution.
AI-written summary · about
related talks
53mFrom Secure Container to Secure Service
19mSandbox to confidential containers: A brief on the evolution of container isolation
32mLotsa security - confining the extra security layer
14mYour Containers Aren’t Alone: Demystifying Container Isolation
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
35mThe Enemy Within: Running Untrusted Code with gVisor
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era