Firecracker serves an entirely different purpose from Kubernetes. Kubernetes is a cluster scheduler but the containers being scheduled still need a runtime (typ

Firecracker serves an entirely different purpose from Kubernetes. Kubernetes is a cluster scheduler but the containers being scheduled still need a runtime (typically Docker, containerd, or CRI-O) to execute the process within the container. These runtimes typically share a single Linux kernel instance and use the kernel cgroups feature to isolate workloads. In multi-tenant environments where each tenant is running unrestricted code this presents and unacceptably high security risk. If a hacker compromises one container and escapes the cgroup confinement they can potentially impact the security of other containers. Fargate is the building block for an alternative container runtime that uses extremely lightweight VMs and isolated kernel instances instead of the more traditional approach of sharing a kernel between all processes.