Hacker News Reader

This is a really interesting read, thanks for the write up. I had no idea they were running these customer services on k8s, given that it is untrusted code and containers are not the best isolation layer. Are there any pointers on how Render approached running untrusted code in k8s?

View on HN

With the right amount of hardening, containers can provide a relatively secure sandbox. It's certainly not built for that which leads to natural weaknesses, but in my experience auditors seem pretty happy with the controls present in OpenShift (page 79): https://www.redhat.com/en/resources/openshift-security-guide...

Containers are just one isolation layer of many we've built into our systems over the years. A topic for another post, and happy to chat if this is something you're working on.

Reply on news.ycombinator.com