Kata Con­tain­ers: basics, function, and ap­pli­ca­tions

Kata Con­tain­ers is a project by an in­de­pen­dent, open-source community that works together to combine the ad­van­tages of a container system with those of a simple virtual machine.

We explain who’s behind the project and how Kata con­tain­ers work. Plus, we’ll show you the ad­van­tages and dis­ad­van­tages and the most popular ap­pli­ca­tion scenarios for the secure container runtime.

Kata Con­tain­ers – a project launched in December 2017 – aims to develop the most light­weight virtual machine possible that works with the same “look and feel” of a container. Kata con­tain­ers are, therefore, easy to use, highly com­pat­i­ble, and can handle a high workload. What’s more, they still offer a high standard of security. Here, the community utilizes stronger isolation ex­ter­nal­ly and a hardware vir­tu­al­iza­tion tech­nol­o­gy in­ter­nal­ly, as a second line of defense.

The Kata Con­tain­ers project is financed and managed by the OpenStack Foun­da­tion (OSF), which is committed to the de­vel­op­ment and in­tro­duc­tion of open in­fra­struc­ture for cloud computing. For this reason, the OSF code of conduct is a key point of reference for the joint work of the open-source community. The project code is hosted on GitHub – under the Apache 2 license. Large, major companies like Google and Microsoft sit on the Kata ar­chi­tec­ture committee.

The OpenStack Foun­da­tion has provided an in-depth in­tro­duc­tion to Kata Con­tain­ers in the following 30-minute YouTube video:

What exactly do the ar­chi­tec­ture and func­tion­al­i­ty of Kata Con­tain­ers look like? To answer this question, we need to look back to the start of the project. In December 2017, the community suc­cess­ful­ly combined and scaled the best parts of Intel Clear Con­tain­ers (an Intel project for secure Linux con­tain­ers) with Hyper runV (a Hy­per­vi­sor-based runtime for open container ini­tia­tive projects). In other words, the per­for­mance of Intel meets the platform in­de­pen­dence of Hyper.

One of the most important aspects in any container system is security. Since con­tain­ers can be stacked or layered on top of each other, security is often extremely difficult to ensure. Both Intel and Hyper, therefore, aim to achieve high flex­i­bil­i­ty in a container en­vi­ron­ment – with similar results, albeit through different means. The simple layering of container formats like Ku­ber­netes on OpenStack or vice versa is just as possible as complex layering of Ku­ber­netes on OpenStack on Ku­ber­netes. This flex­i­bil­i­ty in creating the desired ar­chi­tec­ture sim­pli­fies the use of Kata con­tain­ers con­sid­er­ably, without having to forego security.

With Kata, you can implement both an VM isolation on the container level and container isolation through hardware vir­tu­al­iza­tion. In the case of Ku­ber­netes, VM isolation is not provided to the container level but to the Podman or pods level, because Ku­ber­netes uses the term “pods” instead of “con­tain­ers”. But this guide will continue to refer to “con­tain­ers” for reasons of sim­plic­i­ty.

These prop­er­ties make Kata in­de­pen­dent, highly com­pat­i­ble, and highly secure. Besides x86_64, the ar­chi­tec­ture can also support AMD64, ARM, and IBM p System, and IBM z System. Moreover, Kata Con­tain­ers allows the use of multiple Hy­per­vi­sors like QEMU, NEMU, and Fire­crack­er. In­te­gra­tion into the con­tain­erd project is also possible.

Kata 1.10 is com­pat­i­ble with the Docker Community Edition, but also supports all other industry standards such as the OCI container format, Ku­ber­netes CRI in­ter­faces and some older vir­tu­al­iza­tion tech­nolo­gies, including CRI-O (1.10 commit 393429 or CRI Con­tain­erd version 1.0.0) or OCI Runtime Spec­i­fi­ca­tion (v1.0.0-rc5).

The supported operating systems that run on Kata con­tain­ers include:

• CentOS (7)
• Debian (9, 10)
• Fedora (28, 29, 30)
• Ubuntu (16.04, 18.04)
• Red Hat En­ter­prise Linux (7)
• OpenSUSE (Leap, Tum­ble­weed)

As a result, the open-source project has already achieved the goal of an open-source container en­vi­ron­ment, whose com­po­nents act like con­tain­ers but offer the per­for­mance and security of VMs. Kata Con­tain­ers has, therefore, been able to resolve the old concerns about con­tain­ers, such as scaling.

Con­ven­tion­al con­tain­ers are light, fast, and are easy to integrate. On the other hand, they come with security risks – es­pe­cial­ly when they are found on a single operating system. When the con­tain­ers share a kernel, an I/O path, the same network and memory, it’s enough to simply attack one container in order to jeop­ar­dize all others at the same time.

The situation is entirely different with Kata con­tain­ers: The virtual machines run in a dedicated kernel (operating system kernel), which separates the processes from both the network and E/A, as well as from the memory. In addition to strong isolation, isolation improved with hardware can be used with vir­tu­al­iza­tion VT ex­ten­sions.

There are many arguments in favor of the ambitious open-source project from the OpenStack Foun­da­tion. Even Clear Linux (Intel) has moved away from its pro­pri­etary container tech­nol­o­gy and already supports Kata con­tain­ers with great success. The key reasons include:

• Excellent com­pat­i­bil­i­ty
• Sim­plic­i­ty of use
• High per­for­mance
• High security standard

Another advantage is the low energy con­sump­tion, even with high per­for­mance.

However, Kata is not a dis­tri­b­u­tion for any and all purposes. It’s a special system with some principle lim­i­ta­tions. These include op­er­a­tions that are not allowed by a virtual machine, and re­stric­tions that are to be resolved in future updates. An extensive list of the lim­i­ta­tions is provided by the community in the official doc­u­men­ta­tion on GitHub. Moreover, Kata con­tain­ers currently can only be used on Linux dis­tri­b­u­tions.

Another, not in­signif­i­cant dis­ad­van­tage is that Kata is still a nascent de­vel­op­ment. Nonethe­less, the technical foun­da­tions are promising and are already used across many areas.

As pre­vi­ous­ly mentioned, the community observes the OSF code of conduct. This also en­com­pass­es an open man­age­ment of the entire project and the source code in par­tic­u­lar. This openness is best provided by the com­bi­na­tion of the two in­te­grat­ed and vir­tu­al­ized, open-source code bases. Its many supports include Ku­ber­netes, Docker, OCI, CRI, CNI, QEMU, KVM, and OpenStack.

Clear Con­tain­ers and runV – the technical foun­da­tions of Kata Con­tain­ers – are used by major companies around the world, such as JD.com, one of the highest-revenue online stores in China.

Kata con­tain­ers generally work best where con­tain­ers are needed that are not to be run on a single kernel. This includes areas of ap­pli­ca­tion like con­tin­u­ous in­te­gra­tion and provision (CI/CD), edge computing, vir­tu­al­ized network functions, and con­tain­ers as a service (CaaS). Kata is also perfectly suited to niche im­ple­men­ta­tions. After all, no other container is as simple, efficient, secure, and flexible.