Categories

Tag

sandboxing

View Cards
Mode Paginated
Per page Per batch 48
Architecture

gVisor: sandboxing for multi-tenant containers

gVisor isolates containers by inserting Sentry, a kernel written in Go, between the container process and the real host kernel, shrinking the system-call surface a hostile tenant can reach. Its OCI-compatible runsc runtime drops in where runc used to sit. Use systrap mode, the default since 2023: portable, no special hardware required.

6 min 263 4.6
Architecture

Firecracker: microVMs for multi-tenant services

Firecracker is the Rust-based virtual machine monitor AWS uses in Lambda and Fargate: it boots microVMs in under 125 milliseconds with under 5 MB of overhead. Switching from containers pays off when a shared kernel does not give enough isolation, especially for untrusted LLM agent code, and versus gVisor it wins on I/O performance.

5 min 293