Open Source Summit + Embedded Linux Conference North America 2026

Containers are the de facto deployment model for our applications today, but is your Container Runtime appropriate for multi-tenant workloads?

If you don't know which Container Runtime you're using today, then it's likely that you're using a shared kernel, so your multi-tenant workloads aren't as isolated as you might think they are.

In this talk, we'll demonstrate how MicroVMs can provide a Hardened Container Runtime. We'll build an understanding of why namespaces and cgroups are limited in the isolation they provide, how the MicroVM architecture can provide an isolated kernel, and the open-source tools available today to implement this.

To demonstrate this, we'll use a Multi-Tenant Kubernetes Cluster to show an attack that can break container isolation, and how MicroVMs can mitigate it.