A kernel? In a Container? Explain Yourself!
summary
Kata Containers claims VM-level isolation with container-like speed by running each container inside a lightweight VM with its own guest kernel; project starts in 2015 (Intel Clear Containers), first release 2018 and production adopters in 2019 (Alibaba), 2.0 in 2020. It integrates with Kubernetes via CRI-O/containerd, supports Cloud Hypervisor, Firecracker and QEMU/KVM, uses virtiofs shared filesystem so images aren’t copied into guests, ships an agent rewritten in Rust and a single-binary runtime+VMM for lower overhead and proven production use.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:02Kata Containers history
- 3:57Container security challenges
- 4:40Isolation with VMs
- 5:45Kubernetes integration
- 7:33Use case benefits
- 8:38OpenShift Sandbox
- 9:21Kata 2.0 improvements
- 10:49Security and performance
- 11:58Architecture Rust rewrite
- 12:38Future Rust plans
- 13:22Q&A
related talks
36mKata Containers: Hypervisor-Based Container Runtime
06mKeynote: Introducing Kata Containers
22mKata Containers: Security and Containers Without Compromise
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
47mContainer Security
38mImproving your Kubernetes Workload Security
32mLotsa security - confining the extra security layer