Glossary

An isolated environment for running untrusted code so it can't affect anything outside it.

A Linux kernel feature that gives a process its own private view of a system resource (processes, network, filesystem, hostname…).

Isolates the process-ID number space; the first process inside is PID 1 and cannot see host processes.

Gives a process its own isolated network stack, devices and ports.

Provides an isolated view of the filesystem mount points.

Isolates the hostname and NIS domain name.

Limits and accounts for the resources a group of processes can use — CPU, memory, I/O, process count.

A kernel facility that filters system calls with a BPF program, rejecting forbidden ones before they run.

The interface a program uses to ask the kernel to do something privileged (open a file, send a packet…).

Berkeley Packet Filter — a tiny in-kernel program format; seccomp uses it to evaluate syscalls.

Time-of-check to time-of-use: a race where a value changes between validation and use. Seccomp-BPF avoids it by not dereferencing pointers.

The kernel routine that terminates a process when memory runs out; a cgroup's memory.max can trigger it locally.

An attack that spawns processes endlessly to exhaust the system; the cgroup pids controller caps it.

The set of points where an attacker can try to interact with a system; restricting syscalls shrinks it.

A lightweight virtual machine with minimal device emulation, giving each workload its own kernel (e.g. Firecracker).

Stacking multiple independent controls so an attacker must defeat all of them, not just one.

The orchestrator that dispatches tasks to execution nodes, monitors them, and returns results.

The control plane decides what runs (UI, DB, Job Manager); the data plane runs it (execution nodes). Splitting them enables scaling.