Your Containers Aren’t Alone: Demystifying Container Isolation
summary
Compares concrete isolation options, their overheads and threat models, and when each actually prevents cross-tenant access: lightweight kernel features like namespaces, cgroups, SELinux and seccomp for process-level namespace isolation; user-space filtering via gVisor user-space kernel; full-kernel separation with Firecracker + KVM microVMs or Kata Containers runtime (slower but stronger); hardware-backed protection with TEEs or air-gapped nodes for highest assurance. Notes cloud hardware requirements, performance tradeoffs, and where common CVEs still break isolation.
AI-written summary · about
chapters (12)
- 0:00Container isolation intro
- 1:04Why isolation matters in multi-tenancy
- 2:47App and service isolation
- 4:55Runtime isolation with user space kernels
- 5:37VMs and microVMs for isolation
- 7:23Hypervisor-level isolation tech
- 9:08Container runtimes on microVMs
- 10:12Unikernels and WASM isolation
- 11:37Node isolation and hardware methods
- 12:24Trusted execution environments
- 13:28Air gaps and physical isolation
- 13:49Community and closing
related talks
47mContainer Security
25mYou Can’t Handle the Root! Container Isolation...
29mLayers of Isolation in Kubernetes
19mSandbox to confidential containers: A brief on the evolution of container isolation
46mSecuring Applications and Pipelines on a Container Platform
14mA kernel? In a Container? Explain Yourself!
45mMaking Containers Safer
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads