Capability-driven security with WebAssembly means that you can run tiny functions to host your apps or agents on k8s. CNCF wasmCloud ships an operator and CRD that extend a standard manifest to give you granular capabilities for security, scheduling, and auditing. Tiny artifacts mean you can run Millions of these on a standard node; they run in containers, so they inherit your existing security investments, segmentation, and policies.

A recent case study shows the power - a simple manifest works on Windows, Linux, Mac, and any K8S. The tiny attack surface makes it highly resistant to breaking in or out; deep dive:

https://cosmonic.com/blog/stopping-remote-code-execution-with-a-sandbox/