You run one Pod per customer in a single GKE cluster and customers can run arbitrary code in their Pods. How do you maximize isolation between customer Pods?

The correct option maximizes isolation by leveraging gVisor, a user-space kernel that intercepts system calls and isolates the Pod from the host kernel. Creating a GKE node pool with sandbox type gVisor and setting runtimeClassName: gvisor in customer Pod specs ensures that each customer's Pod runs within its own secure sandbox, preventing arbitrary code from directly impacting the host or other Pods. Binary Authorization whitelists images but doesn't isolate running code. Container Analysis scans for vulnerabilities but doesn't provide runtime isolation. Using the coscontainerd node image is a good practice for security but doesn't offer the same level of workload isolation as gVisor.