Netflix Titus adds single-tenant VM isolation for containers

Netflix introduced single-tenant Titus, a mode that runs one task on its own right-sized EC2 instance while the Compute/Platform team patches the host. Early adopters include stateful, high-throughput streaming workloads where neighbor interference can cause minutes of checkpoint recovery.

• Titus launches millions of containers weekly across tens of thousands of EC2 instances
• Isolation uses an allowlist, anti-affinity, node taints and disabled defragmentation
• Main cost is tens of seconds to boot a fresh instance before image pull
• Netflix rejected Firecracker, gVisor and plain EC2 for specific limits