Definition
Security boundaries between containerized workloads — from shared-kernel namespaces to microVMs and userspace OS libraries.
Key Points
- FTL targets VM-like isolation without VT-x/AMD-V overhead
- Spectrum: Docker cgroups → gVisor → Firecracker/Kata → bare metal