Forgejo

Standard containers share one kernel with everything else on the node, which is a risk for code that can’t be trusted. This post explains how Kata Containers gives each pod its own kernel, what that costs, and how I use it to run CI pipelines and AI agents in it, sandboxed.