CKS Minimize Microservice Vulnerabilities Practice Question
You want to run a container with gVisor (runsc) runtime for sandboxing. Which resource is required to use a non-default runtime?
⚠ Common exam trap
The CKS exam often tests the misconception that node-level runtime installation alone is sufficient to use a non-default runtime, but the CKS exam emphasizes that a RuntimeClass resource must be created and referenced in the Pod spec to enable runtime selection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RuntimeClass resource
In Kubernetes, to use a non-default runtime like gVisor (runsc), you must define a RuntimeClass resource that references the runtime handler (e.g., 'runsc') configured on the node. The RuntimeClass acts as a bridge between the Pod spec and the node's container runtime configuration, allowing the scheduler to select the appropriate runtime for sandboxing. Without a RuntimeClass, the default runtime (typically runc) is used, which does not provide the same isolation level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PodSecurityPolicy
Why it's wrong here
PodSecurityPolicy is a deprecated admission controller (removed in Kubernetes v1.25) that enforced security context constraints such as privileged mode, host namespaces, and volume types. It never had any field or mechanism for selecting an alternative container runtime or a runtime handler like runsc. Runtime selection is handled exclusively by RuntimeClass, which is a separate API resource referenced in the pod spec, so PSP cannot be used to run a pod with gVisor.
- ✗
ContainerRuntime resource
Why it's wrong here
There is no such Kubernetes resource as a 'ContainerRuntime' object. The Kubernetes API does not define a top-level kind with that name; the correct resource for selecting a runtime is a RuntimeClass. A node does have a configured CRI implementation and available runtime handlers, but to use gVisor you must create a RuntimeClass with the handler name 'runsc' and then reference that RuntimeClass from each pod. Trying to manipulate a nonexistent 'ContainerRuntime' resource would result in an API error and has no effect on pod scheduling.
- ✓
RuntimeClass resource
Why this is correct
RuntimeClass is the correct mechanism because it is a cluster-scoped resource that maps a runtime handler name (for example, runsc) to a specific CRI runtime available on nodes. A pod opts into that runtime by setting the runtimeClassName field in its spec. The kubelet reads this field and launches the pod using the corresponding handler, which for gVisor means the runsc OCI runtime executes the container inside a user-space kernel. This abstraction allows you to mix sandboxed and regular pods on the same cluster and update the runtime implementation without changing pod specs.
- ✗
Node runtime configuration only
Why it's wrong here
Installing gVisor and the runsc runtime on each node is a necessary prerequisite, but it does not by itself make Kubernetes use that runtime for any pod. Without a RuntimeClass resource, the kubelet has no API-level mapping between the requested handler and the actual runc or runsc binary, and every pod will default to the configured default CRI runtime (typically runc). Node-level configuration alone cannot be referenced by a pod spec, so you must also create a RuntimeClass and add runtimeClassName to the pod; otherwise only a node's default runtime is used.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.