kata

Sandbox runtimes and CIS checks: gVisor, Kata, kube-bench

Sep 5, 2026

RuntimeClass to pick gVisor or Kata for a workload, and kube-bench to score the node against CIS Kubernetes.