Standard OCI runtime 2. **gVisor (runsc)** — Application kernel providing system call interception 3. **Kata Containers** — Lightweight VMs for container isolation