Kata Containers: Hypervisor-Based Container Runtime
summary
Merge of runV and Clear Containers into an OCI‑compatible runtime that runs one VM per pod to provide hardware isolation while staying fast, claiming ~100 ms bootstrap by using tiny images, memory sharing (KSM) and hotplug tricks. Implements CRI so it works with containerd, CRI‑O or frakti, uses a shim+proxy+in‑VM agent or virtio‑vsock path, and caches images on the host (block devices give near‑bare metal IO). Demo shows isolated L2 tenant networks and normal Kubernetes workflows. 1.0 release planned next year.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:39History
- 6:40Non-Technical Goals
- 8:29Hypervisor Based Containers
- 33:28Questions on the Audience
related talks
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
14mA kernel? In a Container? Explain Yourself!
22mKata Containers: Security and Containers Without Compromise
38mImproving your Kubernetes Workload Security
32mLotsa security - confining the extra security layer
24mOCI, CRI, ??: Making Sense of the Container Runtime Landscape in Kubernetes
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era