Tag
kernel-isolation
- Sep 26, 2026 The Shared Kernel Boundary and What Containers Cannot Isolate Why container isolation is a partition of kernel state rather than a hardware boundary, which attack surfaces remain, and how the layers of defence are composed. virtualization
- Oct 20, 2022 Unprivileged User Namespaces and the Attack Surface They Open Why allowing any process to create a user namespace turns privileged kernel code paths into reachable ones, which subsystems are most exposed, and how the trade is bounded in practice. virtualization