Skip to content
Selected work

Container isolation

Closing a container escape path, fleet-wide

Designed and led adoption of a hardened container runtime architecture that removed a validated escape path across production clusters and hosts.

AI Platform Security Engineer · ISS STOXX · details generalised; specifics stay internal

The problem

A container is a process with a shared kernel. When an escape path is validated in production, the fix has to land everywhere at once — without breaking the workloads that depend on today’s runtime behaviour.

The approach

  1. 01Validated the escape path end to end before proposing anything, so the fix targeted the real mechanism rather than a symptom.
  2. 02Designed the hardened runtime architecture and led its adoption across production clusters and hosts.
  3. 03Applied microVM-based isolation (Kata Containers, runcvm) where a shared kernel was not an acceptable boundary.

The outcome

The escape path was eliminated across production Kubernetes clusters and Linux hosts with no operational disruption.

Stack

Kubernetes · containerd · runc · Kata Containers · runcvm · Linux