Kubernetes is the wrong choice for multi-tenant platforms.
At SpaceScale, we are building a deployment platform on bare metal, and we weighed the pros and cons. The reality is that the standard container ecosystem is simply not built for multi-tenant workloads.
If you run in-house infrastructure for a single company, K8s is fine. It’s the de facto standard, and hiring for it is easy. But if you are building a platform to run services for different customers? It’s a bad choice. You need custom tooling. Here is why:
1. Standard containers share the same kernel as the host. If a customer runs malicious code and breaks out of the container, they now have access to the host kernel and can compromise other customers. It’s a massive security risk.
We are solving this using Firecracker microVMs for extreme isolation. This is the exact same tech AWS uses for Lambda and Fargate. It is the absolute gold standard for high-performance, hardware-level isolation.
2. Most infrastructure teams handle security at the application level (Layer 7). We are dealing with it at Layer 2 and Layer 3
To create dedicated, high-speed infrastructure for customers, we are building a custom scheduler on bare metal. This allows us to leverage our upstream provider's data centers to take advantage of their Layer 2 switches. We would build isolated VLANs, configure internal routing, trunk ports, and allow strictly granular traffic.
Our goal is to make infrastructure feel like magic for developers. Kubernetes won't get us there.
Infrastructure shouldn't be a black box. Magic shouldn't mean hiding the details. The image below is a sneak peek of the developer experience we are building. Devs will see exactly what is happening under the hood from allocating vCPU to configuring internal routing. Transparent, but completely seamless.
Managing thousands of microVMs at scale is a massive challenge, and we are building internal solution to handle the orchestration. Yes, some teams have made K8s work by swapping container runtimes and bending the system to their will. But that is a massive complexity burden that a lean team should avoid.
If you are building a multi-tenant platform, think twice before you pay the Kubernetes tax. and if you are still betting on K8s for multi-tenancy?
please let me know why
#Kubernetes #BareMetal #PlatformEngineering #DevOps