Firecracker has often been recommended (here on HN and elsewhere) for a VM-for container-execution model : https://github.com/firecracker-microvm/firecracker
back
1 comments
There's also Cloud Hypervisor, which is very similar, and based off some of the same crosvm code and ideas.
gvisor; `runsc`: https://gvisor.dev/docs/ :
> gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit. gVisor does not introduce large fixed overheads however, and still retains a process-like model with respect to resource utilization.
https://news.ycombinator.com/item?id=38609105
kata containers: https://github.com/kata-containers :
> Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.