Learn

Start with the two models of isolation, take a container apart into the kernel features it is actually made of, then watch a microVM reuse those same features to build a second wall.

1.Two models: shared kernel vs. own kernel
Every isolation technology is one of two things.
6 min read
2.Anatomy of a container
A container is a process wearing five kernel features. Meet namespaces, cgroups, capabilities, seccomp, and the LSMs, plus OverlayFS, the layer trick behind images.
12 min read
3.Why your container is not a boundary
Three ways out of a default container, and the one that no amount of hardening fixes.
8 min read
4.microVMs, and the primitives you already know
The twist: Firecracker's jailer builds its second wall out of the very same namespaces, cgroups, and seccomp you just learned. The primitives were never 'container tech'.
10 min read
5.Choosing your rung
Match the tier to the threat, cut the mount as small as you can, and lock the egress. The two rules that survive everything else.
7 min read
6.The version you're actually running
You picked the right rung and you are still exposed, because somebody downstream decided which build of it you get. The questions to ask before you adopt anything.
9 min read

When you're done

Go to the sources.

The 11 papers, blog posts, and architecture write-ups these chapters are built on, each with a note on what it settles.