Kata Con­tain­ers: basics, function, and ap­plic­a­tions

Kata Con­tain­ers is a project by an in­de­pend­ent, open-source community that works together to combine the ad­vant­ages of a container system with those of a simple virtual machine.

We explain who’s behind the project and how Kata con­tain­ers work. Plus, we’ll show you the ad­vant­ages and dis­ad­vant­ages and the most popular ap­plic­a­tion scenarios for the secure container runtime.

Kata Con­tain­ers – a project launched in December 2017 – aims to develop the most light­weight virtual machine possible that works with the same “look and feel” of a container. Kata con­tain­ers are, therefore, easy to use, highly com­pat­ible, and can handle a high workload. What’s more, they still offer a high standard of security. Here, the community utilises stronger isolation ex­tern­ally and a hardware vir­tu­al­isa­tion tech­no­logy in­tern­ally, as a second line of defence.

The Kata Con­tain­ers project is financed and managed by the OpenStack Found­a­tion (OSF), which is committed to the de­vel­op­ment and in­tro­duc­tion of open in­fra­struc­ture for cloud computing. For this reason, the OSF code of conduct is a key point of reference for the joint work of the open-source community. The project code is hosted on GitHub – under the Apache 2 license. Large, major companies like Google and Microsoft sit on the Kata ar­chi­tec­ture committee.

The OpenStack Found­a­tion has provided an in-depth in­tro­duc­tion to Kata Con­tain­ers in the following 30-minute YouTube video:

What exactly do the ar­chi­tec­ture and func­tion­al­ity of Kata Con­tain­ers look like? To answer this question, we need to look back to the start of the project. In December 2017, the community suc­cess­fully combined and scaled the best parts of Intel Clear Con­tain­ers (an Intel project for secure Linux con­tain­ers) with Hyper runV (a Hy­per­visor-based runtime for open container ini­ti­at­ive projects). In other words, the per­form­ance of Intel meets the platform in­de­pend­ence of Hyper.

One of the most important aspects in any container system is security. Since con­tain­ers can be stacked or layered on top of each other, security is often extremely difficult to ensure. Both Intel and Hyper, therefore, aim to achieve high flex­ib­il­ity in a container en­vir­on­ment – with similar results, albeit through different means. The simple layering of container formats like Kuber­netes on OpenStack or vice versa is just as possible as complex layering of Kuber­netes on OpenStack on Kuber­netes. This flex­ib­il­ity in creating the desired ar­chi­tec­ture sim­pli­fies the use of Kata con­tain­ers con­sid­er­ably, without having to forego security.

With Kata, you can implement both an VM isolation on the container level and container isolation through hardware vir­tu­al­isa­tion. In the case of Kuber­netes, VM isolation is not provided to the container level but to the Podman or pods level, because Kuber­netes uses the term “pods” instead of “con­tain­ers”. But this guide will continue to refer to “con­tain­ers” for reasons of sim­pli­city.

These prop­er­ties make Kata in­de­pend­ent, highly com­pat­ible, and highly secure. Besides x86_64, the ar­chi­tec­ture can also support AMD64, ARM, and IBM p System, and IBM z System. Moreover, Kata Con­tain­ers allows the use of multiple Hy­per­visors like QEMU, NEMU, and Fire­crack­er. In­teg­ra­tion into the con­tainerd project is also possible.

Kata 1.10 is com­pat­ible with the Docker Community Edition, but also supports all other industry standards such as the OCI container format, Kuber­netes CRI in­ter­faces and some older vir­tu­al­isa­tion tech­no­lo­gies, including CRI-O (1.10 commit 393429 or CRI Con­tainerd version 1.0.0) or OCI Runtime Spe­cific­a­tion (v1.0.0-rc5).

The supported operating systems that run on Kata con­tain­ers include:

• CentOS (7)
• Debian (9, 10)
• Fedora (28, 29, 30)
• Ubuntu (16.04, 18.04)
• Red Hat En­ter­prise Linux (7)
• OpenSUSE (Leap, Tumble­weed)

As a result, the open-source project has already achieved the goal of an open-source container en­vir­on­ment, whose com­pon­ents act like con­tain­ers but offer the per­form­ance and security of VMs. Kata Con­tain­ers has, therefore, been able to resolve the old concerns about con­tain­ers, such as scaling.

Con­ven­tion­al con­tain­ers are light, fast, and are easy to integrate. On the other hand, they come with security risks – es­pe­cially when they are found on a single operating system. When the con­tain­ers share a kernel, an I/O path, the same network and memory, it’s enough to simply attack one container in order to jeop­ard­ise all others at the same time.

The situation is entirely different with Kata con­tain­ers: The virtual machines run in a dedicated kernel (operating system kernel), which separates the processes from both the network and E/A, as well as from the memory. In addition to strong isolation, isolation improved with hardware can be used with vir­tu­al­isa­tion VT ex­ten­sions.

There are many arguments in favour of the ambitious open-source project from the OpenStack Found­a­tion. Even Clear Linux (Intel) has moved away from its pro­pri­et­ary container tech­no­logy and already supports Kata con­tain­ers with great success. The key reasons include:

• Excellent com­pat­ib­il­ity
• Sim­pli­city of use
• High per­form­ance
• High security standard

Another advantage is the low energy con­sump­tion, even with high per­form­ance.

However, Kata is not a dis­tri­bu­tion for any and all purposes. It’s a special system with some principle lim­it­a­tions. These include op­er­a­tions that are not allowed by a virtual machine, and re­stric­tions that are to be resolved in future updates. An extensive list of the lim­it­a­tions is provided by the community in the official doc­u­ment­a­tion on GitHub. Moreover, Kata con­tain­ers currently can only be used on Linux dis­tri­bu­tions.

Another, not in­sig­ni­fic­ant dis­ad­vant­age is that Kata is still a nascent de­vel­op­ment. Non­ethe­less, the technical found­a­tions are promising and are already used across many areas.

As pre­vi­ously mentioned, the community observes the OSF code of conduct. This also en­com­passes an open man­age­ment of the entire project and the source code in par­tic­u­lar. This openness is best provided by the com­bin­a­tion of the two in­teg­rated and vir­tu­al­ised, open-source code bases. Its many supports include Kuber­netes, Docker, OCI, CRI, CNI, QEMU, KVM, and OpenStack.

Clear Con­tain­ers and runV – the technical found­a­tions of Kata Con­tain­ers – are used by major companies around the world, such as JD.com, one of the highest-revenue online stores in China.

Kata con­tain­ers generally work best where con­tain­ers are needed that are not to be run on a single kernel. This includes areas of ap­plic­a­tion like con­tinu­ous in­teg­ra­tion and provision (CI/CD), edge computing, vir­tu­al­ised network functions, and con­tain­ers as a service (CaaS). Kata is also perfectly suited to niche im­ple­ment­a­tions. After all, no other container is as simple, efficient, secure, and flexible.