Surviving Serverless Battle By Secure Runtime, CRI and RuntimeClass
summary
Claims that CRI plus RuntimeClass let Kubernetes run different secure runtimes per pod and that mapping a CRI matrix to RuntimeClass is the practical way to build isolated Serverless. Compares gVisor, Firecracker and Kata: Kata gives a guest kernel and hardware virtualization so pods map to VMs; RuntimeClass is available as RuntimeClass beta in 1.14. Alibaba runs Kata-backed virtual clusters on 5000+ node cluster for multitenancy; caveats include no hostNetwork in Kata and IO/performance tradeoffs and spotty RuntimeClass support in many OSS serverless platforms.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:10Kubernetes + containerd
- 2:46Linux Container
- 6:31Multi-tenancy of Container Runtime layer
- 7:50KataContainers
- 10:25Container Runtime Interface (CRI)
- 11:48CRI Spec
- 17:02RuntimeClass
- 22:17Serverless Project Reinforcement
- 24:45Case Study: Alibaba Serverless Infra
related talks
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
24mOCI, CRI, ??: Making Sense of the Container Runtime Landscape in Kubernetes
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
36mKata Containers: Hypervisor-Based Container Runtime
38mImproving your Kubernetes Workload Security
22mKata Containers: Security and Containers Without Compromise
25mAgentic Zero Trust: at Rest, in Transit, and at Runtime
01h 55mPush multi-tenancy limits in Kubernetes with runtimeclasses