Securing Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
summary
Atlassian runs Bitbucket Pipelines on Kubernetes using Kata Containers (via containerd/CRI-O) to give each pod its own micro-VM/kernel. Proof-of-concept runs and production tuning fix a severe IO bottleneck: 9p FS is slow, so they plug thin-provisioned device-mapper block devices (on NVMe SSDs) into VMs and reach ~250,000 IOPS, restoring build performance. Privileged containers accidentally expose host device-mapper volumes, so a containerd flag prevents mounting those host devices. Metrics use the kubelet runtime-aware metrics endpoint (Kubernetes 1.14+) so runtimes can report per-container stats from inside VMs.
AI-written summary · about
chapters (6)
- 0:00Start
- 7:20containers, the security of VMS.
- 11:14Disk performance
- 14:39Privileged Containers
- 18:31Monitoring
- 22:31Thank you!
related talks
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
38mKata Containers will impact you. Yes, you!
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
22mKata Containers: Security and Containers Without Compromise
32mLotsa security - confining the extra security layer
07mLightning Talk: Production-Grade AI Isolation: K0s + Kata Containers for Zero-Tru...
06m⚡ Lightning Talk: Kata Confidential Containers Meet Persistent Storage: Overcoming CSI Driver Challenges
38mImproving your Kubernetes Workload Security