Saltar a contenido

Week 12 - Sandboxed Runtimes: gVisor and Kata Containers

12.1 Conceptual Core

  • For untrusted workloads (multi-tenant SaaS, untrusted code execution), namespaces+cgroups+seccomp are not enough. The kernel attack surface is too large.
  • Two production-grade alternatives:
  • gVisor (runsc)-a userspace kernel that intercepts syscalls. Lower overhead than VMs; more compatible than seccomp-based sandboxes. Used in App Engine, Cloud Run.
  • Kata Containers-runs each container (or pod) in a lightweight VM. Hardware-accelerated isolation; higher overhead but stronger guarantees. Used by Confidential Containers and Alibaba Cloud.
  • Both are OCI-spec runtimes-drop-in replacements for runc in containerd/CRI-O. The OCI spec abstraction is what makes this possible.

12.2 Mechanical Detail

  • gVisor (runsc):
  • The Sentry component implements a Linux-compatible kernel in user space.
  • The Gofer component proxies file I/O.
  • Configure via runtimeClassName in Kubernetes; configure containerd to register runsc as an additional runtime.
  • Performance: I/O-bound workloads suffer most (gofer hop). CPU-bound workloads near-native.
  • Kata:
  • Each container/pod gets its own micro-VM (Firecracker, Cloud Hypervisor, or QEMU).
  • The kata-agent runs inside the VM; kata-runtime on the host orchestrates.
  • Performance: ~10–20% overhead vs runc; sub-second VM boot via Firecracker.

12.3 Lab-"Two Sandboxes"

  1. Install gVisor. Register as a containerd runtime. Run nerdctl --runtime runsc against a test workload.
  2. Install Kata. Register as a containerd runtime. Run the same workload.
  3. Benchmark both vs runc for: startup time, syscall-heavy workload (e.g., find /usr -type f), and CPU-bound workload (e.g., sysbench cpu).
  4. Document the tradeoffs in a markdown matrix.

12.4 Hardening Drill

  • Read the gVisor security model; identify the syscalls it does not implement (and would refuse). Compare to a default seccomp profile-gVisor is strictly stronger.

12.5 Production Readiness Slice

  • Choose the right runtime for the right workload. Document a per-workload decision matrix in your team's runbook: trusted internal services → runc/crun, customer-supplied code → runsc, regulated/PCI workloads → Kata.

Month 3 Capstone Deliverable

A runtimes-and-daemons/ workspace: 1. containerd-direct/ - week 9 setup + Prometheus wiring. 2.crio-no-k8s/ - week 10 manual pod operations. 3. rootless-systemd/ - week 11 podman + systemd setup. 4.sandbox-bench/ - week 12 runc/runsc/kata comparison report.

Comments