The Sandbox Architecture

A whole system for one job: give each visitor their own short-lived box to run code in, with its own web address, and throw the box away when they leave.

Before you start. Kubernetes is a system that runs programs across a group of machines, called a cluster, and keeps them running. You need one picture from earlier in this track: a container is a fenced-off process, and the fence is built out of the same operating system core - the kernel - that every other container on that machine also has to go through (The Shipping Container (Docker), Processes, Threads & the Kernel covered both). Everything below is what changes when the stranger behind that fence is a person you have never met.

The idea in 30 seconds

A sandbox is a room built to be handed to a stranger and thrown away - the routing and the teardown are the easy half.
A container locks the door between guests. It was never a wall around the pipes: every guest still shares one kernel underneath.
A syscall is the knock a guest’s program sends through the wall to ask the kernel for anything at all - a file, memory, the network.
gVisor answers those knocks with an impostor kernel, so a bug in the real one is never reached.
A hypervisor skips the wall trick entirely and gives the guest a separate little house with its own kernel - the strongest rung, and the most expensive one.
Six rungs, each stopping more than the last, each costing more than the last. Choosing one is a bet you write down, not a checkbox.

Read the story · Skip to the numbers