OK, I get what you are saying now, and I agree if we are talking about KVM. That's not how Kubernetes works by default, so I thought we were talking about cont

OK, I get what you are saying now, and I agree if we are talking about KVM. That's not how Kubernetes works by default, so I thought we were talking about container runtimes. I still disagree strongly from both a practical security and theory standpoint if we are talking about container runtimes implemented using namespaces and cgroups.