Couple Services, Not the Host: Portable Services and Capsules (asg2026)

System extensions (sysexts) become part of the host's /usr, making them available to all users. But what if we want to run tightly coupled services without exposing their binaries to everyone else on the system? This lightning talk will show how to ship a real-world stack (kubelet, containerd, and runc) without making them accessible to the rest... Weiterlesen