Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataHard
A global financial institution is designing a new high-transaction online banking application. The application will use Azure Kubernetes Service (AKS) for container orchestration. To ensure the highest level of workload isolation and prevent potential container escape vulnerabilities, the security architect needs to recommend a container runtime that provides a strong isolation boundary, similar to a virtual machine, for sensitive workloads. Which AKS container runtime should the architect recommend?
- ARunC (default container runtime)
- BDocker Engine
- CKata Containers
- DCRI-O
Show answer & explanationAnswer & explanation
Correct answer: C. Kata Containers
Kata Containers provide a strong isolation boundary by running each container in its own lightweight virtual machine (VM). This offers a higher level of security than traditional container runtimes like RunC, as it mitigates container escape vulnerabilities by leveraging hardware virtualization, making it suitable for highly sensitive workloads requiring VM-like isolation within AKS.
Why the other options are wrong
- A. RunC is the default container runtime for most container engines (including Docker and containerd) and provides standard container isolation, which is not as strong as VM-level isolation and is susceptible to container escape vulnerabilities.
- B. Docker Engine is a popular containerization platform that uses RunC as its underlying runtime and provides standard container isolation, which does not meet the requirement for VM-like isolation against container escapes.
- D. CRI-O is a lightweight container runtime specifically for Kubernetes that implements the Container Runtime Interface (CRI), but it provides standard container isolation, not the enhanced VM-like isolation of Kata Containers.
AKS with Kata Containers
Azure Kubernetes Service (AKS) integration with Kata Containers, providing enhanced security isolation for individual containers by running them within lightweight virtual machines (VMs), leveraging hardware virtualization.
- Container-in-VM isolation
- Leverages hardware virtualization (Intel VT-x, AMD-V)
- Mitigates container escape vulnerabilities
- Suitable for multi-tenant and highly sensitive workloads
Memory trick: Kata cuts containers into isolated VMs.