Glossary • untrusted workload: cannot be certified as safe to run
4
Containers and VMs
5
What's wrong with containers?
6
Assumption Maketh the Ass
7
Rootlessness
8
Rootless State of Union
9
History of Virtualisation
10
Virtual Machine Monitor
11
KVM vs Xen vs QEMU
12
Spectrum of Isolation
13
gVisor vs Firecracker vs Kata
14
gVisor Sentry
15
Firecracker Device Model
16
Kata Containers
17
Honourable mention: rust-vmm
18
Docker & Kubernetes RuntimeClass
19
What are the risks of next gen proc iso?
20
What should I use?
21
Conclusion
Description:
Explore the next generation of process isolation techniques in this conference talk on container security. Examine the history of safely running unsafe processes, compare emerging isolation and security methods, and understand the design decisions driving each project. Learn about breaking in and out of different technologies, and discover which workloads are best suited for various isolation techniques. Gain insights into the challenges of running untrusted code in containers, the evolution of process isolation, and the blurred boundaries between containers and micro VMs. Understand the implications of different isolation technologies for your applications and how to potentially run diverse workloads on the same cluster using different "container" types.
In a Container, Nobody Hears Your Screams - Next Generation Process Isolation