One kernel shared by every container, then gVisor's user-space kernel and Kata's VM per pod, and Agent Sandbox on Kubernetes
click a step for its explanation