Your Containers Are Not as Isolated as You Think .

when we talk about container security we take it like its solved . we add network policies , scan images restrict privileges - but we rarely question the foundation . Every container on your host shares the same Linux kernel . One kernel vulnerability , one misconfigured syscall and the walls in between you containers is down .

this isnt just a theory . its a structured problem .

Unikernels offer a fundamentally differnet model . each app get complied into a self contained image that runs directly on a hypervisor - no shared kernel , no unnecessary OS components , no lateral movement between workloads . This isolation is real not a layered .

But unikernels have always had one big problem : They lived outside the cloud native world . NO DOCKER NO KUBERNETES NO OCI .

URUNC implement this . It is an open souce OCI-compatible container runtime -the RUNC for unikernels .As a contributor and user of the project, I'll walk through how URUNC plugs directly into Docker and Kubernetes, replacing the container process with a unikernel booted inside QEMU or Firecracker. Your manifests don't change. Your pipelines don't change. What changes is what's actually running underneath and how well it's isolated.

This talk is for developers and DevOps engineers who care about what isolation really means in production, and want a practical, open source path to something stronger.

1. container isolation has a structural limit — shared kernel — that no amount of configuration fully solves.

2. URUNC brings unikernel-level VM isolation into Docker and Kubernetes without changing your existing workflow.

3. It is an active, welcoming open source project under Apache 2.0 — easy to try and easy to contribute to.