Kata Containers Version 3.0.0 Arrives: Faster, More Secure, Support for New Environments

The open source project Kata Containers issued version 3.0.0 of the software. Kata Containers is a secure container runtime with lightweight virtual machines that feel and perform like containers but provide stronger workload isolation using hardware virtualization technology as a second layer of defense. This solution offers a fast and secure deployment option for anything from highly regulated workloads to untrusted code, spanning public and private cloud, containers-as-a-service and edge computing use cases.

Since launching in 2017, Kata Containers has been embraced by users who value “the speed of containers with the security of virtual machines.” Kata Containers 3.0.0 builds on software’s most valuable features: security, speed and compatibility with a wide variety of environments and hardware.

Key Features of Kata Containers 3.0.0

• A newly written runtime implementation in Rust and an optional integrated Rust hypervisor, further reducing Kata Containers resource consumption and management complexity.
• Rust removes the overhead of the GO runtime.
• Integrated Rust hypervisor ensures that Kata Containers only spawn one host component for each POD.
• Aligns with the popular trends in the Linux community to rustify core software stack.
• Improved hypervisor support, making Kata Containers more accessible to a wider range of environment configurations.
• Newly added support for GPUs, such as VFIO (Virtual function I/O), which allows safe, non-privileged, userspace drivers and PCI(e) devices in general.
• Upgrade to cloud-hypervisor v26.0 with several improvements to cloud-hypervisor support for Intel TDX.
• Code updates to support the latest stable Linux Kernel release.
• Each deployment of the Kata Container runtime includes its own kernel for increased security & container isolation. The kernel in Kata Containers 3.0.0 has been updated to run v5.19.2.
• Increased compatibility with leading cloud-native technologies.
• Kata Containers supports popular runtimes including (but not limited to) Kubernetes, CRI-O, Containerd and OCI v1.0.0-rc5 Runtime specification.
• Additional security enhancements, including
• Signature verification support with image-rs and offline filesystem KBC
• Support for static resource management functionality in Rust runtime, significantly improving speed and security
• Support for cgroupv2, adopting the latest Linux kernel cgroups features

Recommended AI News: CloudFabrix Announces the Availability of Composable Analytics, Dashboards and Pipelines to Accelerate AIOps and Observability Adoption

“There’s a lot of excitement in the Kata Containers community around how the improved hypervisor support in Kata Containers 3.0.0 expands compatibility with a number of popular environment configurations and hardware technologies, such as GPUs,” said Treva Williams, technical community manager at the Open Infrastructure Foundation. “Kata community members are constantly seeking ways to improve and do not shy away from a challenge, such as rewriting Kata in Rust. Switching to Rust significantly increases speed, performance and safety, so the community’s hard work in making the switch pays huge dividends for Kata users and future contributors as well.”

Kata Containers Valued by Users

“We have integrated Kata Containers into Inspur’s server virtualization system InCloud Sphere and hyper-converged infrastructure system InCloud Rail, and we will continuously promote Kata Containers to our customers and grow together with the community.” —Alex Yan, director of Cloud Computing, Inspur Data CN

“It is my great honor that our team and I have been active contributors and users of Kata Containers since its first day. I think Kata Containers 3.0.0 will be the most exciting release for the new features, such as rustified components, built-in sandboxing and TDX support. In the release cycle of Kata 3.0.0, we deployed it in our product clusters, which helped the team win the Superuser Award this year. Let’s keep working together for a better next release.” —Xu Wang, senior staff engineer, Ant Group

Recommended AI News: Researchers from Gwangju Institute of Science and Technology Develop a New Method for Denoising Images

Kata Containers Community Continues to Expand

Over the Kata Containers 3.0.0 development timeframe, the Kata Containers community added almost 4,000 changes from 235 contributors and 26 organizations including Adobe, Alibaba, ARM, Atlassian, Baidu, Bytedance, Inspur, Google, Microsoft, NVIDIA, Orange, Red Hat and ZTE. The Architecture Committee currently includes members from Ant Group, Apple, Intel and Rivos. Current infrastructure donors include AWS, Google Cloud, Microsoft, PackageCloud, Packet and Vexxhost.

The Kata Containers community has grown since it was announced at KubeCon in December 2017, and open source contributors passionate about container security are invited to get involved. Contributors can expect to work upstream across multiple infrastructure and container orchestration communities, including Kubernetes, containerd / CRI-O, Docker, OCI, CNI, QEMU, rust-vmm, cloud-hypervisor KVM and OpenStack. Get started by connecting with the Kata Containers community.

Confidential Containers Announces First Release

While developing the 3.0.0 release of Kata Containers, several members of the community simultaneously aided in development of the first release of Confidential Containers, an open source project currently in the CNCF sandbox, that integrates existing Trusted Execution Environments (TEE) infrastructure support and technologies with cloud native technologies.

Confidential Containers is an outgrowth of the container isolation feature in Kata Containers, expanded to integrate existing TEE infrastructure support which, among other key security features, allows cloud native application owners to enforce better application security requirements by enabling the protection of in-use data by performing computation in a hardware-based TEE. After many months of development by a dedicated and passionate team of contributors, the CoCo team has completed the Confidential Containers Kubernetes operator. Support for Kata 3.0.0 has been included with the Confidential Containers v0.1.0 release, available for download in the project’s GitHub.

Recommended AI News: Eko Awarded $2.7 Million SBIR Grant from NIH to Develop Pulmonary Hypertension AI

[To share your insights with us, please write to sghosh@martechseries.com]