Isolation & Security

The mechanisms that separate, confine, and protect workloads — from containers to access control to running whole guests.

• Cgroups (cgroups/) — accounting for and limiting resources per group of processes; the basis of containers
• Security (security/) — LSMs, capabilities, seccomp, and the kernel's access-control machinery
• Virtualization (virtualization/) — KVM and how the kernel runs guest machines
• Crypto (crypto/) — the kernel's cryptographic API and hardware acceleration
• Livepatch (livepatch/) — patching a running kernel without rebooting