The Container Runtime Nobody Told You About (And Four Others)

The piece compares runc, gVisor, Kata Containers, Firecracker, and WASM/WASI on the same small Go server.

gVisor, Kata, and Firecracker can run the same OCI image by changing only the runtime flag; WASM/WASI needs a different build target.

Steady-state latency is similar across most options, but cold start and memory usage vary much more.

The takeaway: pick a runtime based on your isolation threat model, compatibility needs, startup time, and resource budget.