Privilege dropping, one capability at a time
KubeVirt's architecture is composed of two main components virt-handler, a trusted DaemonSet, running in each node, which operates as the virtualization agent, and virt-launcher, an untrusted Kubernetes pod encapsulating a single libvirt + qemu process.