More Than Secure: Containerd + KataContainers as Kubernetes Runtime
summary
Refactors KataContainers into a containerd plugin that implements the CRI v2-style shim so Kubernetes can pick VM-isolated runtimes per pod via runtimeClass, routes networking through the CRI, and adds custom volume plugins to reduce hypervisor overhead. Demo boots 100 containers on 60GB node in about two minutes, each Kata running its own kernel (example 4.14 vs host 4.16) and showing host processes unaffected compared with Docker. Integration aims for upstream adoption and lets clusters mix Linux containers and per-sandbox lightweight VM workloads.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:31Kubernetes Project
- 5:22How Will You Communicate with Your Clients
- 6:17How We Run Cargo Containers in Kubernetes
- 16:10Live Demo
related talks
36mKata Containers: Hypervisor-Based Container Runtime
06mKeynote: Introducing Kata Containers
25mSecuring Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
22mKata Containers: Security and Containers Without Compromise
14mA kernel? In a Container? Explain Yourself!
34mLet's Try Every CRI Runtime Available for Kubernetes. No, Really!
38mKata Containers will impact you. Yes, you!