Linux Namespace
Isolates what a process can SEE — PID / Network / Mount / UTS and more.
Isolation Mechanisms
The four kernel-level controls inside the Sandbox Executor. Click for detail.
4 result(s)
Seccomp-BPF
A syscall firewall: rejects forbidden system calls before they run.
Cgroups
Caps how MUCH a process can use — CPU / Memory / I/O / PIDs.
Timeout control
Kills runaway jobs so nothing squats on resources forever.