gVisor

we moved to more isolated containers.

We used a virtual machine called GVisor for that, which also turned out to not be big enough to, it wasn't a general enough computer to solve the problem.

Then we ended up with full-size VMs.

And then we ended up with the problem of, well, now I need 50 of them.

I mean, at the bottom of the stack is a sandboxing technology.

And whether that's GVisor or micro VMs or something else that has yet to be developed, they both need those core concepts of protecting the thing you're running from the rest of the system and vice versa.

And unlike Kubernetes, we don't have a lot of legacy.

There's no body of existing software that we need to be compatible with.

It's single tenant.

It runs in its own sandbox.

Again, that could be GVisor.

It could be MicroVM.

Now, there are several approaches within Linux.

You'll hear namespaces, cgroups, kind of full-on micro VMs like Firecracker and GVisor.

We actually went with Landlocked because it suited us very well for this tool-specific, very fast sandboxing.

But also, we don't require any elevation privileges.

There's a kind of like serverless one, where you, you kind of have code which is, uh, loaded into a function, goes up to the cloud, executes.

Okay? There is a microVM, which is a full virtual machine, okay? Like Firecracker, gVisor.

Uh, you got Docker containers.

That's another type of isolation.