CloudNativeSecurityCon North America 2024

Container sandboxing is one of the best approaches we have to securing high-risk or untrusted container workloads. In the AI-first world, demand for these types of workloads, whether it be running untrusted LLM-generated code or training on proprietary datasets, is growing fast. In this talk you will learn about the different approaches to sandboxing containers and tradeoffs associated with them. Then Lucas will dive deep into the implementation of the open source gVisor sandbox and container runtime. Lucas will discuss new sandboxed hardware accelerator support in gVisor, implementation trade-offs, the ways gVisor is being used to mitigate AI/ML security risks, and the work the gVisor team has done to reduce the performance costs of sandboxing.