Lightning Talk: Production-Grade AI Isolation: K0s + Kata Containers for Zero-Tru...
summary
k0s plus Kata Containers replace runC to launch a micro‑VM per model, giving true kernel separation and claimed mitigation of past runC CVEs; VM provisioning completes in 50–500 ms, supports GPU passthrough to a specified physical core, and yields per‑workload attestation and observable execution. The stack is positioned as FIPS‑capable (via k3os/K3s lineage noted in notes), runs in production for ~3 years at Mirantis, and provides a reproducible blueprint for governed, multi‑tenant AI workloads.
AI-written summary · about
related talks
22mKata Containers: Security and Containers Without Compromise
25mAgentic Zero Trust: at Rest, in Transit, and at Runtime
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era
14mA kernel? In a Container? Explain Yourself!
25mSecuring Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
06mKeynote: Introducing Kata Containers
14mYour Containers Aren’t Alone: Demystifying Container Isolation
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz