It seems strange to use a highly managed deployment environment like Fargate, but then build another deployment tool on top of it to do things in a simpler way.
It feels like EC2 is being reconstructed on a platform meant to hide it.
It feels like EC2 is being reconstructed on a platform meant to hide it.
If pods have added privileges or there is a really low risk tolerance, maybe that's not enough isolation.
Sounds like you can change the container runtime with EKS (not sure if that impacts AWS support) so you could use gVisor or runvm
https://www.verygoodsecurity.com/blog/posts/secure-compute-p...