A team runs semi-trusted third-party code and wants stronger isolation than the default runtime gives, because a kernel exploit inside a container could compromise the host. They want to keep container start-up fast and avoid running a full separate guest kernel per Pod. They choose a runtime that interposes a user-space kernel to intercept and service the container's system calls, shrinking the host kernel attack surface. Which runtime matches this approach?
- AgVisor, which runs a user-space kernel that intercepts container syscalls before they reach the host kernel Correct
- BKata Containers, which wraps each Pod in a dedicated lightweight virtual machine with its own guest kernel
- Crunc, the default OCI runtime that starts containers as host processes sharing the host kernel
- Dchroot, which changes the apparent root directory so the process sees a different filesystem tree
Why A is correct: gVisor inserts a user-space application kernel that handles the container's system calls, so only a narrow set reaches the host kernel, giving stronger isolation without booting a full guest kernel per container.
Why B is wrong: Tempting because Kata also strengthens isolation over the default runtime, but it does so by running a real guest kernel inside a VM, which is exactly the full separate guest kernel the team wanted to avoid.
Why C is wrong: Tempting because runc is the runtime already in use, but it shares the host kernel directly and provides no extra syscall interception, so it does not deliver the stronger isolation being sought.
Why D is wrong: Tempting because chroot is an early isolation mechanism, but it only remaps the filesystem view and offers no syscall filtering or kernel attack-surface reduction.