If you are running containerized workloads on Red Hat OpenShift, then you already benefit from industry-leading process isolation. Security context constraints (SCC) restrict what pods can do, SELinux enforces mandatory access controls, cgroups limit resource consumption, and many permissive Linux capabilities are dropped by default. That said, all of these controls still operate on a shared host kernel. For the majority of workloads, this is perfectly fine. But when you are running untrusted code especially with privileged containers, you can use OpenShift sandboxed containers for an additional layer of assurance.What are OpenShift sandboxed containers?Available on Microsoft Azure Red Hat OpenShift, OpenShift sandboxed containers give you hypervisor-backed workload isolation, where each pod runs inside its own lightweight virtual machine (VM) with a dedicated kernel, layered on top of the already included OpenShift security controls.In this post, we provide an overview on what OpenShift sandboxed containers do, how it works on Microsoft Azure, and when you should consider adopting it for your workloads.What does "sandboxed" mean for your containers?In a traditional container setup, your workloads all share the host's Linux kernel. Think of it as choosing a hostel or a hotel. In a hostel, one person's bad behavior can affect the whole room. With OpenShift sandboxed containers, each sandboxed pod gets its own dedicated kernel inside a lightweight VM, which is more like having your own hotel room with solid walls. You still reside in the same building and share the lobby, but what happens inside each room is completely contained.OpenShift sandboxed containers are built on Kata Containers, an open source project that runs each pod inside its own lightweight VM. If a workload is compromised, the blast radius is confined to that transient VM (which has almost no other software installed), rather than spreading to the host or neighboring pods. In effect, you get the simplicity of containers with the isolation guarantees of virtual machines.In figure 1, you can see a conceptual representation of the difference between a regular pod and a pod utilizing OpenShift sandboxed containers.