Isolating containers and agents

Why this conversation

Containers running on Kubernetes share one kernel. Anything that can affect that kernel can affect every container on it, and a container that is compromised can be the way into the rest of the cluster. For a platform team that runs code it did not write, and more and more code that an AI agent wrote, that shared kernel is the boundary that matters.

Kavitha Daula, VP of Engineering at Edera, hosted the show at the Edera booth on the Wednesday of Open Source Summit Europe in Prague. Asked what Edera is, she started one step back, with isolation in general, and only then came to the product. The story of the week it was filmed is in Open Source Summit Europe 2026: who we met.

A micro-VM for each workload

Edera builds a secure micro-VM in which each workload gets its own guest kernel. Edera calls these zones. If there is a breach, it happens in one zone and does not move across to the others, so the damage is contained to that one workload.

The host asked what a micro-VM maps to: a tenant or a workload. A workload, she said, but the boundaries are the user’s to draw. Several things can go into the same zone, or different workloads can sit in separate zones, and the zones are put together into whatever secure architecture the team wants.

That choice is where the trade-off sits. Security versus performance always comes up, and the person designing the system has to pick: what runs together in one zone, and what is kept apart.

Where isolation is used

The first use case she named is the highly regulated environment, where multi-tenant workloads should not share a cluster with each other. You do not want CI, a database and everything else running together in the same place; each can have its own zone. Healthcare and banking are the sectors she pointed to.

She does not see it as a problem for regulated sectors only. AI workloads and agents are a second case, and she referred to a recent incident involving AI agents to make the point. “Anybody who’s using Kubernetes should be looking at isolation pretty seriously,” she said, and now almost everybody is using AI in one way or another.

AI-written code adds to it. What would have been written in five lines is now 50, and over time nobody knows everything that is in there, or what it can affect. Isolation limits how far any of it can reach.

What comes next

Last year, the interesting work for her was getting Edera to run at scale in a way that is both performant and secure. Now the team is working to run Edera on more than Kubernetes.

What she enjoys most personally is education: making people aware of the security concerns of running workloads in a vanilla container, and of the challenges with Kubernetes itself. The host added that Kubernetes is not one thing either, given all the flavours on the market.

To try it, she pointed to the website, on.edera.dev, where at least one node of Edera can be set up and spun up.