The Hidden Kernel Problem at the Heart of Cloud Native Security

Most of us in the cloud native ecosystem live in YAML. We live in APIs, orchestration, controllers and container tooling. We live in user space. The Linux kernel sits beneath all of that as an invisible force we rarely think about. Our day-to-day work touches Kubernetes abstractions, not page tables or task structs.

From a security perspective, that is a problem. The kernel is the real boundary. Every container, every Extended Berkeley Packet Filter (eBPF) program, every Container Network Interface (CNI) plugin and every isolation feature…