Multi-tenant user code
On a multi-tenant platform, one tenant's code runs on the same host as another's. ZViz gives every tenant a fresh set of namespaces, zero capabilities, and a strict syscall policy, so the isolation between tenants is enforced by the kernel rather than by convention.
The problem
Multi-tenancy means one tenant’s code shares a host with another’s. If the isolation between them is only a convention — same large syscall surface, default capabilities, shared filesystem view — then a single tenant escaping their box compromises their neighbours.
How ZViz helps
Each tenant workload runs in its own ZViz container with:
- A fresh user, pid, mount, ipc, and uts namespace — the kernel boundary is the tenant boundary.
- Zero capabilities and a Landlock ruleset — no privileged operations, constrained filesystem access.
- A selective-denial seccomp filter — the dangerous syscalls a tenant might use to escalate are denied.
- cgroups v2 limits — one tenant cannot starve another of memory, PIDs, or CPU.
Because the boundary is enforced by kernel primitives rather than convention, “next to each other” stays “isolated from each other.”
When to reach for something else
Where regulation or threat model demands a hardware-virtualized boundary per tenant, a MicroVM is the right tool. For platforms that can rely on a hardened syscall policy, ZViz gives you strong per-tenant isolation without a guest kernel per tenant. See how it works.
Frequently Asked Questions
Is namespace isolation enough for multi-tenancy?
Namespaces are necessary but not sufficient on their own — plain runc has them and still exposes a large syscall surface. ZViz adds zero capabilities, a Landlock ruleset, and a selective-denial seccomp filter on top, shrinking what any tenant can reach.
When should I use a VM per tenant instead?
If your compliance or threat model requires a hardware-virtualized boundary between tenants, use a MicroVM like Firecracker. ZViz offers a lighter, container-shaped boundary for tenants a strict syscall policy can contain.
Related
AI agent code execution
Run LLM-generated code inside ZViz so a prompt injection fails at the kernel boundary, not in production.
Use caseCI sandboxing
Run builds on opaque dependency trees with a smaller kernel attack surface than plain runc.
Use caseCode-execution platforms
Back notebooks, REPLs, and "run this snippet" products with a runtime that assumes every submission is hostile.