Which two container runtimes are recognized for providing enhanced security features, such as stronger isolation through virtualization?

• A. Docker and containerd
• B. runc and runv
• C. LXC and LXD
• D. Kata Containers and gVisor

Answer: (D)

Strong isolation between a container workload and the host is achieved by introducing a boundary beyond standard containerization. Kata Containers and gVisor are built around this idea. Kata Containers runs each container inside a lightweight virtual machine, using virtualization to separate the container from the host. That VM boundary makes it much harder for a compromised container to impact the host or other workloads. gVisor, on the other hand, provides a sandbox by implementing a user-space kernel that traps and emulates Linux system calls for the container. This creates a separate kernel environment, limiting what the container can do in relation to the host kernel without requiring full hardware virtualization. Together, they’re recognized for offering enhanced security through virtualization-like isolation. The other runtimes tend to rely on standard host-kernel containers (namespaces and cgroups) or different deployment models, which don’t provide the same level of virtualization-based isolation.