Hacker News Reader

> - containers are each isolated in a VM (aka virtualized)

Why are you assuming containers are virtualized? Is there some container runtime that does that as an added security measure? I thought they all use namespaces on Linux.

View on HN

It’s becoming standard as a security measure. See: Kata containers, Firecracker VM

Not so; neither Kata containers nor Firecracker are in widespread public use today. (Source: I work for AWS and consult regularly with container services customers, who both use AWS and run on premise.)

Ah, good to know!

Reply on news.ycombinator.com