Containers are powerful because they isolate workloads, but isolation isn’t free. Every namespace, cgroup, and security mechanism introduces overhead — sometimes negligible, sometimes significant enough to cause production headaches.

In this talk, we’ll explore the performance costs of container isolation. Using Go benchmarks, we’ll measure how syscalls are slowed down by seccomp, how overlayfs adds filesystem overhead, and how virtual networking introduces latency. We’ll then connect these findings to Kubernetes: why some workloads see performance cliffs when containerised, and how to mitigate them through tuning, resource allocation, or runtime choices.

Attendees will leave with a realistic picture of the trade-offs between isolation and performance, and practical strategies to balance them in production systems.

Learning Outcomes

* Understand the sources of container performance overhead.
* Measure filesystem, networking, and syscall costs in Go.
* Recognise workloads sensitive to container isolation.
* Learn mitigation strategies (tuning, runtime choices, limits).
* Make informed trade-offs in Kubernetes deployments.

Target Audience

* Developers optimising performance-critical workloads.
* Kubernetes practitioners running mixed workloads (CPU/memory heavy).
* Engineers curious about syscalls, filesystems, and Linux isolation.