The previous post ended here: with every task crammed into one program, one failure takes down all of them, and anybody's code can read everybody's data and keys.

The fix is natural — give every task a container of its own . Throw it away afterwards; nobody touches anybody.

On Kubernetes this is almost embarrassingly easy to write. Easy enough to make you wonder whether the last post was overreacting.

The code: a task arrives, a container gets built

# request comes in → ask K8s to build a new container v1 . create_namespaced_pod ( namespace = "default" , body = pod_manifest )

# then keep asking "ready yet? ready yet?" — this is the wait the user sits through while True : pod = v1 . read_namespaced_pod ( name = task_id , namespace = "default" ) if pod . status . phase == "Running" : break time . sleep ( 0.5 ) # asking too often overwhelms the management system

return { "time_to_interactive_seconds" : round ( time .…