Article Overview
Sandboxed containers place an additional isolation layer between the container and the host OS, reducing direct interaction with the host kernel. The focus is on lowering the risk of container breakout that can arise in conventional container architectures.
Representative runtimes include the following.
- gVisor: A user-space kernel (Sentry) intercepts and emulates syscalls
- Kata Containers: Runs containers in lightweight VMs to separate kernels
Differences from Conventional Containers
Conventional containers use host kernel syscalls directly through runtimes such as containerd and cri-o. This benefits performance, but kernel vulnerabilities can increase risk in multi-tenant environments.
The key to sandboxed containers is bypassing or restricting this path to reduce direct interaction with the host kernel.
gVisor vs Kata Containers
| Category | gVisor | Kata Containers |
|---|---|---|
| Isolation method | A user-space kernel intercepts and handles syscalls | A guest kernel runs inside a lightweight VM |
| Host kernel access | Indirect (emulation) | Indirect (through the guest kernel) |
| Security model | Isolation based on syscall mediation | Hypervisor-based VM isolation |
| Performance overhead | Present (varies significantly by case) | Present (generally higher) |
| Startup time | Slower than conventional containers | Tends to be slower than conventional containers |
| Operational complexity | Relatively low | Relatively high |
| Debugging difficulty | Moderate | High |
| Good fit | Workloads needing isolation where VM-level isolation is too burdensome | Workloads that require strong isolation |
Performance Trade-offs
Stronger security comes with potential increases in CPU and memory usage and startup delays due to user-space kernel/virtualization overhead. The article recommends choosing this approach in environments that can absorb these costs.
Use Cases
The original article mentions the following real-world use cases.
- OpenAI: Uses gVisor for high-risk workloads
- Cloudflare: Uses gVisor in build infrastructure
- NVIDIA: Isolates AI/ML workloads with Kata Containers
- Blink: Uses gVisor for EKS Pod security isolation
Recommended Scenarios
The article recommends the following environments.
- Environments such as CI/CD platforms where users execute arbitrary code
- Serverless/Function services (AWS Lambda, Cloud Run, etc.)
- Executing customer code in SaaS environments
In trusted internal microservices environments, on the other hand, the performance overhead may be considered too high.
References
- Original article: https://devopscube.com/sandboxed-containers/