GKE Sandbox: Independent operating system kernel to each container

Re:GKE Sandbox: Independent operating system kernel to each ... by yoshiat on Wednesday May 15, 2019 @10:01PM (#19925531)

(Co-author of the post)

The fact that gVisor is being used in multiple services at Google is probably the confusing part. In case of GKE Sandbox, the users here are external and using Cloud (specifically GKE). The target use case is to add defense in depth to their pods running on potentially shared GKE Nodes (VMs) for Multi-Tenancy. Our talk at Next'19 [1] includes a story by one of our customers, which may help understanding the use cases.

[1] https://www.youtube.com/watch?v=TQfc8OlB2sg

[ Parent | on HN ]

Re:GKE Sandbox: Independent operating system kernel to each ... by bogomipz on Wednesday May 15, 2019 @10:53PM (#19925749)

Thanks for the link that does make the use case clear i.e multitenancy/SaaS. Am I correct in assuming though that when someone creates a K8S cluster via GKE that the containers that make up their cluster such as the kubelets and masters are all running in VM underneath?

[ Parent | on HN ]

Re:GKE Sandbox: Independent operating system kernel to each ... by yoshiat on Wednesday May 15, 2019 @11:01PM (#19925786)

Yes, exactly. https://cloud.google.com/kubernetes-engine/docs/concepts/clu...

[ Parent | on HN ]