Isolating Workloads in Multi-Tenant Kubernetes Clusters

Examines the shortcomings of default OS-level container isolation and surveys options such as Kata Containers and gVisor, then introduces urunc, which runs workloads in lightweight VMs (unikernels or minimal Linux) for VM-grade isolation while preserving cloud-native performance and simplicity. (No public slide PDF; conference video available.)