Pods sandboxed with gVisor by default
Containers normally share the node’s Linux kernel, so a kernel exploit in one container can reach the node and everything else on it. Podplane runs Pods in gVisor by default, which gives each Pod its own application kernel. Apps don’t need any changes to use it.
Workloads that need the node’s kernel directly can run under runc instead, but only in namespaces a cluster admin has allowed. Being able to deploy into a namespace is never enough to opt out of the sandbox.
Admission policies apply these rules to every new Pod, including Pods created by controllers, and reject unsupported runtimes rather than falling back to runc.