CKS Minimize Microservice Vulnerabilities Practice Question
You want to run a container with gVisor for sandboxing. After installing gVisor and creating a RuntimeClass named 'gvisor', which Pod configuration enables it?
⚠ Common exam trap
The trap is that candidates may mistakenly think that nodeSelector, environment variables, or annotations can select a runtime, but only spec.runtimeClassName directly references a RuntimeClass object. For gVisor, a CNCF sandbox project, the RuntimeClass must be created separately, and the Pod simply references it by name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set spec.runtimeClassName: gvisor
The `spec.runtimeClassName` field in a Pod spec is the standard Kubernetes mechanism to select a specific container runtime for that Pod. When a RuntimeClass named 'gvisor' is created, setting `spec.runtimeClassName: gvisor` instructs the kubelet to use the gVisor runtime (runsc) to run the Pod's containers, providing an additional sandboxing layer for security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set spec.runtimeClassName: gvisor
Why this is correct
The Pod spec includes a runtimeClassName field that references a cluster-scoped RuntimeClass resource, which declares the handler (for gVisor, typically runsc) and may also include scheduling and overhead settings. When this field is set, the kubelet uses that handler to create the sandbox and containers, making it the only native, supported mechanism for per-Pod runtime selection. Without it, the default runtime such as runc is used, even if gVisor is installed on the node.
- ✗
Set spec.nodeSelector with 'gvisor: true'
Why it's wrong here
The nodeSelector field is a scheduling constraint that tells the scheduler to only place the Pod on nodes with matching labels; it has no effect whatsoever on which container runtime executes the Pod's containers. Even if a node is labeled 'gvisor=true', the kubelet will still use the default or explicitly specified runtime via runtimeClassName, not a label-based selection. Thus, using nodeSelector for runtime selection is unworkable and leaves the Pod running in the default runtime.
- ✗
Define an environment variable RUNTIME=gvisor in the container
Why it's wrong here
Environment variables are defined per-container and are only visible to the application process after the container has started; they are never interpreted by the kubelet or the container runtime to adjust runtime behavior. The kubelet determines which runtime handler to use by reading the Pod's runtimeClassName field (or falling back to the default), not by inspecting variable names like RUNTIME. Defining RUNTIME=gvisor would simply set a string inside the container's environment and accomplish no change in sandboxing.
- ✗
Add an annotation 'container.runtime: gvisor' to the Pod
Why it's wrong here
Annotations are unstructured key/value metadata attached to a Pod for external tools, clients, or controller logic, and Kubernetes core does not act on annotations to choose a runtime. The kubelet looks specifically at the runtimeClassName field in the PodSpec and resolves it against RuntimeClass objects; there is no built-in annotation capable of altering that resolution. Adding 'container.runtime: gvisor' would have no effect, and only runtimeClassName can correctly select a RuntimeClass.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.