---
title: "Cloud, NFV, containers, and multi-tenancy"
chapter: "18"
---

# Cloud, NFV, containers, and multi-tenancy

Cloud-native LI separates a provider control plane, service-plane points, mediation, evidence, and operations across software-defined infrastructure. Shared platforms can improve resilience but create insider, metadata leakage, snapshot, backup, and jurisdiction risks.

> **Safety boundary:** this chapter teaches lawful, governed system design from
> public standards. It does not provide operational targeting, activation,
> decryption, surveillance-evasion, or covert collection instructions.

## The mental model

| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| **NFV/CNF** | Network functions run as software on shared infrastructure | Platform admins are a new trust domain |
| **Control-plane isolation** | LI administration uses dedicated identities, networks, and policy | Namespace labels alone are insufficient |
| **Secret workload identity** | Functions authenticate without shared static credentials | Rotation and revocation must not reveal target state |
| **Ephemeral compute** | Instances are replaceable and stateless where possible | Sensitive buffers, crash dumps, and disks still need handling |
| **Multi-tenancy** | Infrastructure serves many customers or operators | Case metadata must not cross tenant or support boundaries |
| **Data residency** | Processing and backups stay in approved locations | Autoscaling and disaster recovery can move data |

## Apply it as a controlled workflow

1. Create separate trust zones for provider platform, LI control, observation, mediation, and audit.
2. Use dedicated workload identities, network policy, encrypted storage, and narrow operator roles.
3. Disable or govern snapshots, debugging, memory dumps, and support access.
4. Keep case details out of labels, metrics, traces, billing, and general logs.
5. Test node loss, rescheduling, backup, restore, region failover, and forensic acquisition.
6. Prove deletion and key retirement across active, backup, and replicated stores.

## Evidence to demand

- Cloud control-plane logs can be reviewed without revealing target identifiers.
- Platform support cannot attach debuggers to sensitive workloads by default.
- Residency policy is enforced in placement and restore workflows.
- A compromised tenant cannot infer LI activity through shared resource side channels.

## Failure to reason about

An autoscaler metric is named with a case identifier. A general cloud operator cannot read content but can infer who is under surveillance. Treat metadata as sensitive and use opaque operational identifiers.

## Feynman check

Cloud computers are rented rooms in a huge building. Locks, keys, cleaners, cameras, backup storage, and emergency moves all need rules—not just the application door.