Is The Agent In The Room With Us Right Now?

At Netflix we run hundreds of thousands of workloads every day covering every discipline of engineering from backend, frontend, data, machine learning, to the new age of AI agents. As our compute environment has evolved from a Mesos-based implementation to an increasingly more standard Kubernetes environment, we’ll discuss how our isolation strategies have both changed over time and enabled us to run everything Netflix needs in a safe and reliable manner.

In this talk we will elaborate on the benefits and drawbacks of the various isolation strategies and integration points we use in our compute environment and how we arrived at them. This will include topics such as advanced SECCOMP / AppArmor / landlock enforcement, stringent RBAC network configurations, container and user isolation via user namespaces, storage isolation, and general noisy neighbour multi-tenancy improvements.