The practice and landing of Kata containers in Ant Group and Alibaba Group
summary
Ant/Alibaba run Kata on thousands of servers hosting what they call billions of service endpoints and use Kata for resource and fault isolation, not just security. They replace QEMU with rust-vmm, rewrite the agent from Go to Rust and swap gRPC for ttrpc, cutting agent memory from ~11 MB to ~3 MB. They add an ops channel for in-guest debugging and a hot upgrade mechanism to replace runtime and agent without stopping long‑running services, and report these changes working in production.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:27What's Kata Containers
- 1:39Highlights Kata Features
- 4:34Tradition container's mutual interference Container A's response time would be delayed
- 8:00What we do to improve Kata's resource usage
- 11:12The benefits got
- 13:18Hot upgrade for kata containers
- 14:49Kata Containers in Ant & Alibaba Group
related talks
22mKata Containers: Security and Containers Without Compromise
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era
33mUse Cases and Lessons Learned From Kata Container Deployment in Production
25mSecuring Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
33mBuild Serverless with K8s, Kata Containers and Bare Mental Cloud in...
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
33mUse Cases and Lessons Learned From Kata Container Deployment in Production
53mFrom Secure Container to Secure Service