Questão de Container Runtimes #019e3a4f

The correct answer is the group of container runtimes that provide additional sandboxed isolation and elevated security: runsc (gVisor) and kata (Kata Containers).

How it Works

Traditional container runtimes like runc and crun share the host kernel directly, offering limited isolation. In contrast, sandboxed runtimes introduce an additional layer of isolation:

• runsc (gVisor): Implements a user-space kernel that intercepts system calls from the container, providing a security boundary without requiring hardware virtualization.
• kata (Kata Containers): Uses lightweight virtual machines (VMs) to run each container in its own dedicated kernel, leveraging hardware virtualization for strong isolation.

Why the Correct Value is Right

runsc and kata are explicitly designed for enhanced security through sandboxing. They are often used in multi-tenant environments where untrusted workloads must be isolated from the host and from each other.

Why the Incorrect Values are Wrong

• runc and cgroups: runc is the standard OCI runtime that runs containers directly on the host kernel. cgroups is a kernel feature for resource limiting, not a runtime. This combination does not provide sandboxed isolation.
• docker and containerd: Docker is a container platform that uses containerd as its runtime manager, which in turn uses runc by default. Neither provides additional sandboxing beyond standard container isolation.
• crun and cri-o: crun is a fast, low-level OCI runtime similar to runc. cri-o is a CRI-compliant container engine that typically uses runc or crun. This combination lacks the extra isolation layer of sandboxed runtimes.