Podcast
SALT LAKE CITY – Cisco Isovalent's open source leader has had a front-row seat to a decade of development in cloud-native infrastructure, including the convergence of networking and security.
At the intersection of all these fields sits Isovalent, stewards of the Cilium and Tetragon open source network monitoring and security projects based on the extended Berkeley Packet Filter (eBPF) Linux kernel utility. Isovalent was acquired by Cisco in late 2023, and has since been incorporated into Cisco's switching gear, which runs on Linux. Cilium uses eBPF to orchestrate traffic using a lightweight service mesh within Kubernetes clusters, while Tetragon performs application runtime observability and policy enforcement.
Liz Rice, chief open source officer at Isovalent, obviously has a vested interest in container-based runtime security rather than the microVM-based agent sandboxes making headlines during KubeCon here this week. But she pointed out that the merits of microVMs are still under discussion within the Cloud Native Computing Foundation (CNCF) community, where she sits on the governing board.
"We're seeing a lot of debate … around what's necessary from a sandboxing point of view," she said during an interview on the IT Ops Query podcast here this week. "A lot of that is a work in progress. … It's almost philosophical now, about what's the right isolation boundary for agents."
MicroVMs vs container isolation debate
Proponents of microVMs, which are lighter-weight than traditional VMs but retain OS-level isolation, strike a balance between the performance and efficiency of containers and the stronger boundaries around VMs. MicroVMs, including Google's gVisor and Kata containers, integrate with the agent sandbox projects Nvidia and Google contributed to the CNCF. Other updates in the open source community from Broadcom and SUSE this week also blurred the lines between previously divided domains of VM and container management.
Isovalent's Tetragon also provides infrastructure-based policy enforcement but uses a container rather than a VM, which Rice said is better suited to the high-scale, wire-speed network operations that agentic infrastructure requires.
"There's a lot of potential in these microVMs, and it's interesting to compare this to five years ago, let's say, when spinning up a VM was a matter of many, many, many seconds at least, whereas now with microVMs, it's much faster," she said. "But it does create different tensions for things like observability … and the performance is not quite the same as we're going to get with the regular container runtime."
While microVMs provide stronger isolation, they can also obscure visibility into running workloads compared to containers, Rice said. Preventive measures to contain malicious or misaligned AI agents can only go so far – and when, not if, suspicious behavior occurs, deep, rapid visibility is crucial to catching it quickly.
In some ways it's not an either-or discussion: most enterprises will pursue multiple layers of security, a practice known as defense in depth. But balancing between the scale and performance agents demand and running them safely will remain vital, according to Rice.
For example, Tetragon underpins Cisco's Live Protect virtual patching feature, rolled out in June. It can quickly shield Cisco smart switches from being attacked using newly discovered software vulnerabilities faster than those vulnerabilities can be patched upstream.
"We have to have runtime security protections and mitigations because we just can't afford the time to roll out patches. We can't anticipate all possible attacks," Rice said. "It's been possible in theory for a long time, but there's always [been] concern about affecting normal operations. But with the onslaught of vulnerabilities, the balance of risk is changing, and it makes more and more sense for people to put those guardrails in."
Beth Pariseau, lead editor for infrastructure news at TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
