You are developing a training platform for Docker and Kubernetes on Google Kubernetes Engine (GKE). The application operates on a GKE cluster. Each time a user starts a tutorial, a pod is generated for them to execute arbitrary code. For security, it's essential to isolate all customer pods. What is the best method to achieve this isolation?