Engineering / advanced
Isolation for shared compute platforms
Analyze interference and authorization across resource, storage, network, and accelerator boundaries while distinguishing fairness from confidentiality.
Your route through engineering
Follow the path or begin with a question. Every lesson is open.
Your place, at your pace. Progress is optional and saved only in this browser when available.
Read / explore / reason
Inside this module
Module 01 advanced
Isolation for shared compute platforms
Analyze interference and authorization across resource, storage, network, and accelerator boundaries while distinguishing fairness from confidentiality.
- 01
Tenant isolation: define the claim before choosing a control
Separate fairness, availability, confidentiality, and integrity, then state the identity, resource, and observation boundaries that each claim needs.
27 min - 02
CPU fairness: distinguish weights, quotas, and placement
Analyze relative fair-class weights and aggregate CPU budgets without treating either as an exclusive core or a latency guarantee.
27 min - 03
Memory interference: capacity limits leave shared traffic
Distinguish resident memory limits, cache allocation, and bandwidth control while measuring the actual hardware domain that tenants share.
27 min - 04
Storage fairness: count operations and bytes separately
Calculate request-size-dependent ceilings and trace buffered I/O attribution before interpreting a device limit as a tenant service guarantee.
27 min - 05
Network sharing: shape traffic and authorize reachability
Analyze aggregate tenant traffic envelopes while keeping bandwidth controls separate from NetworkPolicy, encryption, and application authorization.
27 min - 06
Namespaces organize tenants; authority comes from policy
Trace authentication, additive RBAC, admission, workload identity, and runtime enforcement across a Kubernetes tenant boundary.
27 min - 07
Accelerator sharing: name the partition and the fault domain
Compare MIG instances with a precisely scoped MPS provisioning mode, accounting for memory QoS, shared engines, versioned features, and residual trust.
27 min - 08
Tenant budgets: coordinate rate, bursts, and in-flight work
Prevent replicated limiters and premature cancellation accounting from multiplying a tenant’s allowed load.
27 min - 09
Side channels: define what an adversary can observe
Distinguish forbidden direct access from secret-dependent shared-resource observations, with explicit attacker capabilities and bounded experimental claims.
27 min - 10
Validate isolation with adversarial load and honest oracles
Design paired tenant experiments that expose interference, authorization failures, deadline loss, and measurement bias rather than rewarding incomplete samples.
27 min