InsideContainers Are Isolated from Each Other, Not from the Kernel
Topic 32 of my Kubernetes journey: why containers share one kernel, what gVisor and Kata Containers actually change, and picking a runtime with RuntimeClass.
Topic 32 of my Kubernetes journey: why containers share one kernel, what gVisor and Kata Containers actually change, and picking a runtime with RuntimeClass.
Topic 25 of my Kubernetes journey: use seccomp to block the syscalls a container never needs, why Kubernetes ships it off, and how to turn it on.
Topic 24 of my Kubernetes journey: what a Linux syscall is, why containers share one kernel, and how to watch them live with strace and Aqua Tracee (eBPF).