Containers share the host kernel, while microVMs run a separate kernel behind a virtualization boundary. For web apps, untrusted workloads, or multiple tenants, how do you decide which isolation model is enough?
When is container isolation enough, and when would you use a microVM?
Asked by
+bracketed~enthusiasm!
Answers
Start with what you trust. Containers can be a reasonable fit for workloads you control, where the main goal is packaging and separating services rather than defending against a hostile tenant.
For untrusted code or customers who shouldn't be able to affect one another, I'd give the stronger boundary of a microVM serious consideration. A full VM may also fit, depending on the isolation and operational requirements. Neither choice removes the need to configure and maintain the host securely.
Reply to this answer
A container is still a host process, not a small virtual machine. Namespaces change what it can see, and cgroups control resources, but the workload still uses the host kernel. That shared kernel is the key distinction when you're deciding what kind of boundary you need.
Reply to this answer
You can also harden a container rather than treating the choice as completely unrestricted container versus VM. Rootless containers, a locked-down user, network restrictions, SELinux, and read-only filesystems with only necessary writable paths are all things to consider.
That reduces what the workload can do, but it doesn't change the shared-kernel model. Whether that's enough still depends on the workload and what you're trying to protect.
Reply to this answer
Add your answer
Answers are reviewed before publication.
off-center-but-functional:
And the actual container configuration matters too. Namespaces and resource controls are pieces of the setup, not a guarantee that every container has the same restrictions.