What I learned running Kata Containers in production

I run workloads that execute untrusted code on the same nodes as things I care about. CI runners that build arbitrary pull requests, agent workloads that hand users an interactive shell. For a while r