Phase 06 - Sandboxing, Containers, Virtualization, and Isolation
Duration: 8 weeks (Months 12-13)
Objective: understand what remains shared in each isolation model and build a layered workload
runner with testable security properties.
Required Theory
- Isolation threat models, process and kernel attack surface, namespaces, user namespaces, cgroups v2, seccomp-BPF, capabilities, LSMs, mount propagation, rootless operation, and filesystem, network, device, and resource isolation.
- OCI image/runtime specifications, container lifecycle, runc architecture, image trust, runtime sockets, container escape classes, and orchestration boundaries.
- gVisor architecture concepts: syscall interception, user-space kernel tradeoffs.
- KVM, VM exits, guest/host boundaries, virtio, Firecracker design, jailer model, microVM lifecycle.
- Multi-tenant threats, confused deputies, metadata/control-plane access, side channels, noisy neighbors, and observability gaps.
8-Week Build Sequence
| Week | Lab | Proof |
|---|---|---|
| 1 | threat-model an untrusted job runner | assets, malicious workloads, host/control-plane boundaries |
| 2 | minimal container runtime in Go | PID/mount/UTS/network namespace tests and safe teardown |
| 3 | cgroups v2 | CPU, memory, PID, and I/O limits; controlled exhaustion tests |
| 4 | seccomp and capabilities | generated allowlist, default-deny tests, capability minimization |
| 5 | rootless/user namespaces and filesystem | UID mapping, read-only root, tmpfs, bind-mount policy |
| 6 | network and device isolation | no-network/egress-policy modes, device deny policy, audit events |
| 7 | syscall-intercept toy and gVisor comparison | architecture experiment, compatibility/performance report |
| 8 | Firecracker microVM lab | documented local launch/jailer workflow and container/microVM comparison |
Runnable lab portfolio and deep guides
- WARMUP.md derives namespaces, capabilities, seccomp, cgroups, OCI/runc, gVisor, KVM, Firecracker, and control-plane trust from the workload threat model.
- HITCHHIKERS-GUIDE.md is the operator hardening and attack-test guide for containers, gVisor, and Firecracker.
- Lab 01 - Sandbox Policy Compiler rejects privileged modes, broad capabilities, unsafe mounts, host namespaces, metadata egress, missing limits, seccomp allow-all, Firecracker without jailer, and incomplete cleanup.
- Lab 02 - Seccomp Policy Regression Analyzer reviews syscall drift after upgrades and separates approved additions from forbidden or unexplained calls.
- Lab 03 - MicroVM Lifecycle State Machine enforces allocation, start, cancellation, result collection, and complete Firecracker-style resource cleanup.
The runtime is educational and must carry a prominent warning that it is not production-ready. Run only benign adversarial fixtures: fork bombs under PID limits, memory/CPU consumers, forbidden file reads, blocked syscalls, and network policy tests.
Capstone - Mini Sandbox Platform
Build a CLI and declarative policy supporting:
- namespace and rootless modes;
- cgroup resource ceilings;
- seccomp profile;
- capability drop and no-new-privileges;
- read-only root with controlled writable mounts;
- optional network denial or allowlisted proxy;
- environment/secret injection without logging;
- structured lifecycle and policy-decision audit events;
- timeout, cancellation, cleanup, and orphan detection.
Required security review compares it honestly with rootless containers, gVisor, Kata, and Firecracker. Document unsupported syscalls, race windows, host dependencies, side channels, control-plane risk, and why layered isolation is needed.
Tools and Sources
Go or Rust, unshare, nsenter, cgroups v2, libseccomp, capabilities tooling, rootless
Podman, OCI specs, runc source/docs, gVisor and Firecracker architecture documentation, KVM docs,
strace, bpftrace, and benchmark tooling.
Measures
- 100% negative policy fixtures fail closed and produce an audit event.
- Resource-exhaustion fixtures remain inside declared limits.
- Repeated cancellation leaves no process, namespace, mount, TAP device, or cgroup behind.
- Benchmark reports startup, syscall-heavy, network, and memory overhead with methodology.
- Threat model identifies at least 20 abuse cases and control owners.
Evaluation Checklist
- Explain what is shared by a process, container, gVisor sandbox, and microVM.
- Design a seccomp profile from observed and reviewed behavior without blind auto-approval.
- Explain user namespace benefits and historical risk tradeoffs.
- Prevent access to host files, devices, network, metadata services, and runtime sockets.
- Defend policy and observability choices during a design review.
Common Mistakes and Interview Questions
Mistakes: calling namespaces a security boundary without layers, running as root for convenience, mounting runtime sockets, writable host paths, unlimited PIDs, hidden cleanup failures, benchmark claims without workloads, and equating a toy runtime with runc/Firecracker.
Questions: design multi-tenant code execution; choose container vs gVisor vs microVM; contain a compromised build job; explain seccomp TOCTOU/compatibility tradeoffs; secure the sandbox control plane; investigate an isolation-policy denial spike.
Portfolio and Stretch
Publish code, policy examples, negative tests, benchmark, threat model, and limitations. Stretch: Landlock/AppArmor integration, signed image policy, attested microVM concepts, snapshot/restore analysis, fuzzing the policy parser, or differential syscall behavior tests.