From Secure Container to Secure Service
summary
Compares Kata Containers and gVisor earlier findings and reports on recent Kata developments—lightweight hypervisors (Nemu, Firecracker), virtio-fs for improved POSIX filesystem performance, and containerd shimv2 integration—and explains how Ant Financial builds on those secure sandbox runtimes to deliver broader secure-service goals by combining secure containers with a ServiceMesh layer.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:47Back to KubeCon NA 2018
- 2:52Additional Background
- 5:10Container Runtimes on Linux
- 6:22A Brief History of Kata Containers
- 8:19Shim v2 Support in Kata 1.5
- 10:53FireCracker Support in Kata 1.5
- 11:50Work with Kubernetes RuntimeClass
- 12:46Virtio-fs Support in Kata 1.7
- 20:03Summary of the Progress
- 21:42Evolution of the Financial Grade Infrastructure
- 22:19ServiceMesh
- 23:17Service Mesh + Kata Containers
- 24:38Demo: Kata + Service Mesh
- 27:29SOFAMesh: Service Mesh Practice in Ant Financial
- 28:40Practice: Trusted Identity Service
- 29:28The Next Step
related talks
53mFrom Secure Container to Secure Service
32mLotsa security - confining the extra security layer
22mKata Containers: Security and Containers Without Compromise
19mSandbox to confidential containers: A brief on the evolution of container isolation
20mKata * TEE = A Lego-like Two-way Sandbox for Seamless Security and Privacy
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
06mKeynote: Introducing Kata Containers
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era