Strong Resource Performance Isolation
Container instances of different tenants on the same node do not share the kernel. In the event of a kernel or runtime vulnerability, malicious code cannot attack other applications and system services or steal data. Users with host machine permissions cannot view the runtime status of containers, including executing command lines or accessing all application runtime-related information.
Highly Compatible
Complies with the OCI container implementation specifications and uses Kubernetes standard RuntimeClass for seamless integration with Kubernetes. There is no need for additional processing of container images, and applications running on runC containers can run directly on secure containers without modification.
High Maturity
The secure sandbox (rune) runtime utilizes Kata Containers technology, which has gained widespread support in the industry. It boasts a robust and active open-source community and has been successfully deployed on a large scale in several financial institutions and internet companies.
Security and Compliance
Whether deployed in public clouds, private clouds, or physical machines, system must implement strong kernel-level isolation for container instances.
