* [Topics](/en/topics "Topics") * [Containers](/en/topics/containers "Containers") * What are sandboxed containers? What are sandboxed containers? ============================== Published April 11, 2023•*1*-minute read Copy URL Jump to section --------------- OverviewWhy sandboxed containers?OpenShift and sandboxed containers Overview -------- A sandbox is a tightly controlled environment where an application runs. Sandboxed environments impose permanent restrictions on resources and are often used to isolate and execute untested or untrusted programs without risking harm to the host machine or operating system. Sandboxed containers add a new runtime to container platforms keeping your program isolated from the rest of the system using lightweight virtual machines which then start containers inside these pods. Sandboxed containers are typically used in addition to the security features found within Linux [containers](https://www.redhat.com/en/topics/containers). [Learn more in our video series](https://www.youtube.com/playlist?list=PLaR6Rq6Z4IqeEFFta_3T3x2VubI8wbVF9) Why are sandboxed containers important? --------------------------------------- Sandboxed containers are ideal for workloads that require extremely stringent application-level isolation and security, like privileged workloads running untrusted or untested code and a Kubernetes-native experience. By using a sandboxed container you can further protect your application from remote execution, memory leaks, or unprivileged access by isolating: * developer environments and privileges scoping * legacy containerized workloads * third-party workloads * resource sharing (CI/CD Jobs, CNFs, etc.) and deliver safe multi-tenancy ![Kata Containers as a Service](/rhdc/managed-files/styles/wysiwyg_full_width/private/Kata-Containers-RedHatOpenShift-1.png.webp?itok=XvmbdY1c) Red Hat resources ----------------- [Read the report](/en/resources "Read the report") How does Red Hat OpenShift work with sandboxed containers? ---------------------------------------------------------- [Red Hat OpenShift sandboxed containers](https://cloud.redhat.com/blog/the-dawn-of-openshift-sandboxed-containers-overview), based on the [Kata Containers](https://katacontainers.io/) open source project, provides an additional layer of isolation for applications with stringent security requirements via Open Container Initiative (OCI)-compliant container runtime using lightweight virtual machines running your workloads in their own isolated kernel. Red Hat OpenShift achieves this through our certified Operator framework which manages, deploys, and updates the Red Hat OpenShift sandboxed containers Operator. The Red Hat OpenShift sandboxed containers’ Operator delivers and continuously updates all the required bits and pieces to make [Kata Containers](https://katacontainers.io/) usable as an optional runtime on the cluster. That includes but is not limited to: * the installation of [Kata Containers](https://katacontainers.io/) RPMs as well as [QEMU](https://www.qemu.org/) as [Red Hat CoreOS extensions](https://docs.openshift.com/container-platform/4.10/post_installation_configuration/machine-configuration-tasks.html#rhcos-add-extensions_post-install-machine-configuration-tasks) on the node. * the configuration of [Kata Containers](https://katacontainers.io/) runtime at the runtime level using [CRI-O runtime handlers](https://github.com/cri-o/cri-o/blob/master/docs/crio.conf.5.md#crioruntimeruntimes-table) and at the cluster level by adding and configuring a dedicated RuntimeClass for [Kata Containers](https://katacontainers.io/). * a declarative configuration to customize the installation such as selecting which nodes to deploy [Kata Containers](https://katacontainers.io/) on. * checks the health of the overall deployment, and report problems during the install. Red Hat OpenShift sandboxed containers are now [generally available](https://cloud.redhat.com/blog/introducing-red-hat-openshift-4.10). Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management -------------------------------------------------------------------------------- Read the 2025 Gartner® Magic Quadrant™ for Container Management to learn why Red Hat OpenShift has been named a “Leader” for the 3rd year in a row. [Keep reading](/en/engage/gartner-magic-quadrant-container-management-analyst-report "Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is a Linux container? Find out more about Linux containers, which are a set of 1 or more processes that are isolated from the rest of the system. [Read the article](/en/topics/containers/whats-a-linux-container "article | what is a linux container?") ### What is container orchestration? Container orchestration automates the deployment, management, scaling, and networking of containers. [Read the article](/en/topics/containers/what-is-container-orchestration "article | what is container orchestration?") ### What is Kubernetes? Kubernetes is a container orchestration platform that eliminates many manual processes involved in deploying and scaling containerized applications. [Read the article](/en/topics/containers/what-is-kubernetes "article | what is kubernetes?") Containers resources -------------------- ### Related content * Blog post [Red Hat Named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management for the Third Consecutive Year](/en/blog/red-hat-named-leader-2025-container-management) * Blog post [Zero trust starts here: Validated patterns for confidential container deployment](/en/blog/validated-patterns-confidential-container-deployment) * Blog post [Deploy sensitive workloads with OpenShift confidential containers](/en/blog/deploy-sensitive-workloads-with-openshift-confidential-containers) * Blog post [Confidential containers on Microsoft Azure with Red Hat OpenShift Sandboxed Containers 1.10 and Red Hat Build of Trustee](/en/blog/confidential-containers-microsoft-azure-red-hat-openshift-sandboxed-containers-110-and-red-hat-build-trustee) ### Related articles * [What is a Linux container?](/en/topics/containers/whats-a-linux-container) * [What is container orchestration?](/en/topics/containers/what-is-container-orchestration) * [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless) * [What is Kubernetes?](/en/topics/containers/what-is-kubernetes) * [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware) * [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop) * [What is Podman?](/en/topics/containers/what-is-podman) * [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client) * [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers) * [Containers vs VMs](/en/topics/containers/containers-vs-vms) * [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing) * [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai) * [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow) * [What are microservices?](/en/topics/microservices/what-are-microservices) * [What is container security?](/en/topics/security/container-security) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [what is Buildah?](/en/topics/containers/what-is-buildah) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns) * [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws) * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd) * [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes) * [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers) * [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes) * [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring) * [What is a golden image?](/en/topics/linux/what-is-a-golden-image) * [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services) * [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference) * [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry) * [What is Skopeo?](/en/topics/containers/what-is-skopeo) * [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators) * [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift) * [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator) * [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [What is KubeLinter?](/en/topics/containers/what-is-kubelinter) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare) * [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management) * [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure) * [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders) * [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift) * [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management) * [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap) * [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes) * [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus) * [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes) * [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations) * [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac) * [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial) * [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture) * [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment) * [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus) * [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture) * [What is CaaS?](/en/topics/cloud-computing/what-is-caas) * [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns) * [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster) * [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus) * [What is Jaeger?](/en/topics/microservices/what-is-jaeger) * [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization) * [What is Clair?](/en/topics/containers/what-is-clair) * [What is Knative?](/en/topics/microservices/what-is-knative) * [What is etcd?](/en/topics/containers/what-is-etcd) * [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices) * [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers) * [What is Docker?](/en/topics/containers/what-is-docker) * [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod) [More about this topic](/en/topics/containers "More about this topic")