Webinar Description
Key Takeaways
- MicroVMs offer stronger workload isolation than traditional container runtimes by providing each tenant with a dedicated kernel
- Standard container isolation mechanisms such as namespaces and cgroups have inherent limitations in multi-tenant environments
- Live demonstration of container escape attacks and MicroVM-based mitigation on a multi-tenant Kubernetes cluster
- Relevant for platform engineers, DevOps practitioners and security architects managing shared infrastructure
Introduction
As organisations increasingly consolidate workloads onto shared Kubernetes clusters, the security boundaries between tenants have come under renewed scrutiny. Beyond Containers: Why MicroVMs are Essential for Multi-Tenant is a technical session scheduled for July 2026 that examines the limitations of conventional container runtimes and presents MicroVM technology as a hardened alternative. The session is designed for infrastructure engineers, security professionals and platform teams responsible for operating multi-tenant environments where workload isolation is a critical concern.
The timing of this discussion reflects a broader industry shift. Container adoption has matured to the point where many organisations now run diverse workloads from multiple internal teams or external customers on shared infrastructure. This consolidation delivers significant efficiency gains but introduces complex security considerations that the original container model was not designed to address.
About This Event
This technical session explores the architectural differences between traditional container runtimes and MicroVM-based alternatives. The presentation moves beyond theoretical discussion to include a practical demonstration using a multi-tenant Kubernetes cluster, where attendees will observe an attack capable of breaking container isolation and see how MicroVM technology can prevent such breaches.
The session builds foundational knowledge before progressing to advanced concepts, making it accessible to practitioners who may not have previously examined their container runtime configuration in detail. A key premise of the talk is that many organisations are unaware of which container runtime underpins their deployments, and this lack of visibility often means workloads share a kernel without operators fully understanding the security implications.
The Shared Kernel Problem in Container Isolation
Containers have become the dominant deployment model for modern applications, offering portability, resource efficiency and rapid scaling. However, the isolation mechanisms that containers rely upon were not originally designed as security boundaries. Linux namespaces partition system resources such as process trees, network interfaces and mount points, while cgroups constrain resource consumption including CPU, memory and I/O bandwidth. Together, these kernel features create the appearance of isolated environments, but all containers on a host continue to share the same underlying kernel.
This shared kernel architecture presents a fundamental challenge in multi-tenant scenarios. A vulnerability in the kernel itself, or a misconfiguration that permits privilege escalation, can potentially allow a malicious or compromised workload to affect other tenants on the same host. The attack surface includes kernel exploits, container escape vulnerabilities and misconfigurations in security contexts or capabilities.
For single-tenant environments or development workloads, this risk profile may be acceptable. In multi-tenant production environments, particularly those subject to regulatory requirements or handling sensitive data, the shared kernel model requires careful evaluation.
How MicroVMs Strengthen Workload Isolation
MicroVMs represent a hybrid approach that combines the operational characteristics of containers with the isolation properties of virtual machines. Unlike traditional containers, each MicroVM runs its own dedicated kernel within a lightweight virtual machine. This architectural change means that even if an attacker compromises a workload and escapes the container boundary, they encounter a separate kernel rather than gaining access to the host kernel shared by other tenants.
The MicroVM model emerged from efforts to provide stronger isolation without sacrificing the speed and density that make containers attractive. Technologies in this space are designed to boot in milliseconds and consume minimal memory overhead, making them practical for environments that require rapid scaling and high workload density.
This session will examine the open-source tooling available for implementing MicroVM-based container runtimes. These tools integrate with existing container orchestration platforms, allowing organisations to adopt hardened runtimes without fundamentally restructuring their deployment pipelines or operational practices.
Practical Demonstration of Container Escape and Mitigation
A central component of the session involves a live demonstration on a multi-tenant Kubernetes cluster. The presenter will execute an attack that successfully breaks container isolation under a traditional runtime configuration, illustrating how an attacker could potentially access resources belonging to other tenants or the underlying host.
The demonstration will then show the same attack attempted against workloads running under a MicroVM-based runtime. By providing each workload with its own isolated kernel, the MicroVM architecture contains the attack within the compromised virtual machine, preventing lateral movement to other tenants or the host system.
This practical approach allows attendees to observe the concrete security differences between runtime configurations rather than relying solely on architectural diagrams or theoretical explanations.
Who Should Attend
This session is particularly relevant for platform engineering teams responsible for designing and operating shared Kubernetes infrastructure. Security architects evaluating the isolation guarantees of their container platforms will find the technical analysis of namespace and cgroup limitations valuable for risk assessments. DevOps practitioners managing multi-tenant environments, whether serving internal development teams or external customers, will gain practical insight into hardened runtime options.
The content assumes familiarity with container fundamentals and Kubernetes concepts. Attendees should understand basic container operations, though deep expertise in kernel internals is not required as the session builds this context progressively.
Conclusion
As container orchestration platforms mature and organisations consolidate increasingly diverse workloads onto shared infrastructure, the question of appropriate isolation boundaries becomes more pressing. This session provides both the theoretical foundation and practical demonstration necessary to evaluate whether traditional container runtimes meet the security requirements of multi-tenant deployments, and how MicroVM technology can address gaps where they do not.