kata-containers

documentation

Shell2018–2022

kata-containers / documentation · Archived

documentation

Kata Containers version 1.x documentation (for version 2.x see https://github.com/kata-containers/kata-containers).

Systems & Infrastructure Learning & Reference

Explore on GitHub Read Hacker News discussions

6Distinct people

6Mentions

0Explicit recommenders

491GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Kata Containers version 1.x documentation (for version 2.x see https://github.com/kata-containers/kata-containers).

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

firecracker-microvm/firecracker-containerd · linked in 2 of the same discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year6 dated mentions

Observed mentions: 2018-12-21 18:03:36 UTC to 2022-03-16 21:37:54 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	1	1
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	1	1
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	0	0
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	3	3
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	1	1

What Hacker News says

6 sources

flurie·Mar 16, 2022

Both Kata Containers and UTM support virtio-fs, so this is not strictly true. The former can be used as a stand-in replacement for the runtime used by docker desktop[1]. With the latter, one could use a UTM-backed guest as a docker runtime in macOS[2] or run docker directly on the guest[3]. [1] https://github.com/kata-containers/documentation/blob/master... [2] https://www.codeluge.com/post/setting-up-docker-on-macos-m1-... [3] https://www.lifeintech.com/2021/11/03/docker-performance-on-...

In Speed boost achievement unlocked on Docker Desktop 4.6 for Mac

benatkin·Jul 1, 2021

This is new and may not be used much, but it is possible to use part of Kata with part of Firecracker. https://github.com/kata-containers/documentation/wiki/Initia...

In Monitoring Elixir Apps on Fly.io with Prometheus and PromEx

hardwaresofton·Apr 22, 2021

> Containers are not a security measure. They're acceptable for some resource constraint considerations, but you should not ever use them because of security concerns. If that's something to worry about, use VMs at the very least. This is repeatedly really commonly, but is bordering on wrong more and more every year. At the lowest level it's not even completely correct. Containers are resource + namespace isolation -- cgroups and namespaces -- isolation and kernel-assisted resource hiding/access control is absolutely a facet of good defence-in-depth. Enhanced security is not a core feature of containerization as a whole but it can absolutely help with your security posture. For what % that satement is wrong, it's even more so because it fails to consider the container runtime. Container runtimes these days (containerd is the best one IMO)

Read the rest

include ways to run containers at different levels of isolation (VMs and as micro kernels), so a move to containers can absolutely help security posture, because now you don't have to pull out packer/ansible/etc to build your VM, you can just take the same container you were running and change the runtime. Time to ship/launch improved security features is important, and containers can reduce that burden for teams. Containers are a process isolation and resource control tool -- they can absolutely aid in security posture. Would you say the same about BSD Jails? Just so there's some more value here, here are some projects that are somewhat close to cutting edge (though it's been a while) in this space that I like: - nabla-containers.github.io/ - https://github.com/firecracker-microvm/firecracker-container... - https://github.com/kata-containers/runtime (see https://github.com/kata-containers/documentation/blob/master...) - https://rootlesscontaine.rs/ - https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2... - https://starkandwayne.com/blog/the-capable-kernel-an-introdu... The container ecosystem surfaces a lot of really cool resource limiting and isolation techniques and puts them in very close reach.

In Tiny Container Challenge: Building a 6kB Containerized HTTP Server

ffk·Apr 9, 2021

If it's using firecracker, it's probably using KVM virtualization while ensuring that the memory the VM consumes is not pinned... that is, that the VM can be swapped out of memory. For reference, firecracker was created by AWS to run and secure AWS Lambda. The hypervisor is written in rust and uses seccomp to eliminate unnecessary system calls. They open sourced it a few years back. What you gain is a stronger security boundary. Just FYI, since 2019, you can also do this in Kubernetes using Kata containers + containerd which will happily shim firecracker. The setup is not simple though. https://github.com/kata-containers/documentation/wiki/Initia... Overall, fly.io building infrastructure on this pattern and making it accessible is fantastic. Looking forward to seeing how this continues to evolve and am happy to see more infra build on to

Read the rest

p of firecracker. Very exciting!

In Docker without Docker

mgerdts·Jan 4, 2019

In addition to the firecracker-containerd[0] architecture, there's also firecracker support in kata containers[1]. While firecracker aims to be as lean as possible[2], kata aims to be portable[3]. It would be swell if the bits that run inside the VM and the protocol that goes over the vsock or vserial proxy were interoperable, but I see that as rather unlikely to happen soon. 0. https://github.com/firecracker-microvm/firecracker-container... 1. https://github.com/kata-containers/documentation/wiki/Initia... 2. https://firecracker-microvm.github.io/ 3. https://github.com/kata-containers/documentation/blob/master...

In The Firecracker virtual machine monitor

pliu·Dec 21, 2018

The documentation for kata seems fairly straightforward for a single host install. Install the kata packages, modify docker daemon to change the run time, then use Docker the usual way. https://github.com/kata-containers/documentation/blob/master...

In Hyper.sh cloud service will shut down on Jan 15