70 lines
5.0 KiB
XML
70 lines
5.0 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="440" viewBox="0 0 1180 440" role="img" aria-label="Two isolation models compared. Left: three containers as processes sharing one host kernel, separated only by dotted namespace lines - an escape lands on the host. Right: each pod boots inside its own microVM with its own guest kernel behind the hardware hypervisor - an escape lands inside a disposable virtual machine, not on the host.">
|
|
<rect width="1180" height="440" fill="#ffffff"></rect>
|
|
|
|
<!-- titles -->
|
|
<text x="60" y="52" font-family="ui-monospace,Menlo,Consolas,monospace" font-size="17" font-weight="600" fill="#0f172a">namespaces: one shared kernel</text>
|
|
<text x="640" y="52" font-family="ui-monospace,Menlo,Consolas,monospace" font-size="17" font-weight="600" fill="#0f172a">Kata: a kernel per pod</text>
|
|
|
|
<!-- ===== LEFT: shared kernel ===== -->
|
|
<!-- three container processes, dotted separations -->
|
|
<g font-family="ui-monospace,Menlo,Consolas,monospace" font-size="14" text-anchor="middle">
|
|
<rect x="60" y="84" width="130" height="86" rx="8" fill="none" stroke="#0c8fce" stroke-width="2" stroke-dasharray="6 5"/>
|
|
<text x="125" y="122" fill="#0f172a">container</text><text x="125" y="142" fill="#64748b">process</text>
|
|
<rect x="215" y="84" width="130" height="86" rx="8" fill="none" stroke="#0c8fce" stroke-width="2" stroke-dasharray="6 5"/>
|
|
<text x="280" y="122" fill="#0f172a">container</text><text x="280" y="142" fill="#64748b">process</text>
|
|
<rect x="370" y="84" width="130" height="86" rx="8" fill="none" stroke="#c026d3" stroke-width="2" stroke-dasharray="6 5"/>
|
|
<text x="435" y="122" fill="#0f172a">untrusted</text><text x="435" y="142" fill="#64748b">process</text>
|
|
<!-- escape arrow: through the dotted floor into the kernel -->
|
|
<path d="M435 172 L435 208" stroke="#c026d3" stroke-width="2.5" marker-end="url(#am)"/>
|
|
<text x="522" y="196" fill="#c026d3" font-size="13">escape = host</text>
|
|
<!-- one kernel slab -->
|
|
<rect x="60" y="214" width="440" height="64" rx="8" fill="#eef2f7" stroke="#334155" stroke-width="2"/>
|
|
<text x="280" y="242" fill="#0f172a" font-weight="600">ONE host kernel</text>
|
|
<text x="280" y="262" fill="#64748b">shared by every container and the node</text>
|
|
<!-- host hardware -->
|
|
<rect x="60" y="292" width="440" height="46" rx="8" fill="none" stroke="#94a3b8" stroke-width="2"/>
|
|
<text x="280" y="321" fill="#64748b">host hardware</text>
|
|
<text x="280" y="376" fill="#64748b" font-size="13">dotted lines are namespaces:</text>
|
|
<text x="280" y="396" fill="#64748b" font-size="13">visibility control, not a security boundary</text>
|
|
</g>
|
|
|
|
<!-- ===== RIGHT: kata microVMs ===== -->
|
|
<g font-family="ui-monospace,Menlo,Consolas,monospace" font-size="14" text-anchor="middle">
|
|
<!-- two microVMs, solid walls, each with its own guest kernel -->
|
|
<g>
|
|
<rect x="640" y="84" width="220" height="150" rx="10" fill="none" stroke="#334155" stroke-width="3"/>
|
|
<text x="750" y="112" fill="#0f172a">pod</text>
|
|
<rect x="662" y="126" width="176" height="42" rx="6" fill="none" stroke="#0c8fce" stroke-width="2"/>
|
|
<text x="750" y="152" fill="#0f172a">container process</text>
|
|
<rect x="662" y="180" width="176" height="38" rx="6" fill="#eef2f7" stroke="#7c3aed" stroke-width="2"/>
|
|
<text x="750" y="204" fill="#7c3aed">own guest kernel</text>
|
|
</g>
|
|
<g>
|
|
<rect x="890" y="84" width="220" height="150" rx="10" fill="none" stroke="#334155" stroke-width="3"/>
|
|
<text x="1000" y="112" fill="#0f172a">untrusted pod</text>
|
|
<rect x="912" y="126" width="176" height="42" rx="6" fill="none" stroke="#c026d3" stroke-width="2"/>
|
|
<text x="1000" y="152" fill="#0f172a">agent process</text>
|
|
<rect x="912" y="180" width="176" height="38" rx="6" fill="#eef2f7" stroke="#7c3aed" stroke-width="2"/>
|
|
<text x="1000" y="204" fill="#7c3aed">own guest kernel</text>
|
|
</g>
|
|
<!-- escape arrow: contained inside the VM wall -->
|
|
<path d="M1000 160 Q 1052 168 1046 186" fill="none" stroke="#c026d3" stroke-width="2.5" marker-end="url(#am)"/>
|
|
<text x="1010" y="256" fill="#c026d3" font-size="13">escape = still inside a throwaway VM</text>
|
|
<!-- hypervisor + hardware -->
|
|
<rect x="640" y="272" width="470" height="46" rx="8" fill="#eef2f7" stroke="#334155" stroke-width="2"/>
|
|
<text x="875" y="301" fill="#0f172a" font-weight="600">hypervisor (KVM) - CPU-enforced boundary</text>
|
|
<rect x="640" y="332" width="470" height="42" rx="8" fill="none" stroke="#94a3b8" stroke-width="2"/>
|
|
<text x="875" y="359" fill="#64748b">host hardware (VT-x)</text>
|
|
<text x="875" y="406" fill="#64748b" font-size="13">runtimeClassName: kata - same kubectl, different boundary</text>
|
|
</g>
|
|
|
|
<!-- divider -->
|
|
<line x1="573" y1="70" x2="573" y2="400" stroke="#e2e8f0" stroke-width="2"/>
|
|
|
|
<defs>
|
|
<marker id="am" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto">
|
|
<path d="M0 0L10 5L0 10z" fill="#c026d3"/>
|
|
</marker>
|
|
</defs>
|
|
</svg>
|
