Exercise: run a Pod in a sandboxed runtime

Host: worker (root) + controlplane · Time: 12 min · Domain: Minimize Microservice Vulnerabilities

Task

• Register a RuntimeClass named sandboxed backed by runsc (gVisor).
• Run Pod isolated in namespace prod with it.
• Prove the sandbox is in effect.

Acceptance criteria

• kubectl get pod isolated -n prod -o jsonpath='{.spec.runtimeClassName}' → sandboxed
• kubectl exec -n prod isolated -- dmesg | grep -i gvisor shows gVisor output, or uname -a reports a gVisor kernel.
• The Pod is Running, not Pending.

Solution

sudo apt-get install -y runsc
sudo tee -a /etc/containerd/config.toml >/dev/null <<'EOF'
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
  runtime_type = "io.containerd.runsc.v1"
EOF
sudo systemctl restart containerd

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata: {name: sandboxed}
handler: runsc
---
apiVersion: v1
kind: Pod
metadata: {name: isolated, namespace: prod}
spec:
  runtimeClassName: sandboxed
  containers:
  - name: app
    image: busybox:1.36
    command: ["sleep", "3600"]

handler must match the containerd runtime key exactly. A Pending Pod means no
node advertises that handler.