Security
Sandboxing Untrusted Workloads in Kubernetes: gVisor, Kata Containers, and Why Your Container Runtime Is One Syscall Away From a Breach
gVisor and Kata Containers solve the isolation problem containers were never designed to solve. Here is how to sandbox untrusted workloads in Kubernetes before a kernel exploit does it for you.