The project Kata Containers 4.0 has been released, providing a stack for organizing container execution with isolation based on full-fledged virtualization mechanisms. Developed by Intel and Hyper, the project merges the technologies of Clear Containers and runV, with code written in Go and Rust. Distributed under the Apache 2.0 license, the project is overseen by a working group formed under the OpenInfra Foundation, that includes companies such as Canonical, China Mobile, Dell/EMC, EasyStack, Google, Huawei, NetApp, Red Hat, SUSE, and ZTE.
Kata is built on a runtime that enables the creation of compact virtual machines running on a full hypervisor, as opposed to traditional containers that rely on a shared Linux kernel and isolation through namespaces and cgroups. This approach provides a higher level of security to prevent attacks exploiting Linux kernel vulnerabilities.
Notably, Kata Containers 4.0 has transitioned to a new default runtime called runtime-rs, written in Rust. The previous runtime, written in Go, remains available as an option but is deprecated and planned for removal in the 5.0.0 branch. Significant enhancements in memory consumption, performance, startup time, and security have been achieved through the migration to the Rust-based runtime. Functionality remains largely similar, with deprecated or unmaintained features being excluded. Some features of the new runtime-rs include support for various hypervisors like Cloud Hypervisor, Firecracker, Dragonball, and QEMU, as well as architecture support for ARM64, Intel/AMD (x86_64), IBM s390x, IBM PowerPC, and RISC-V.
Additionally, the new runtime facilitates GPU forwarding to containers when using QEMU, and integrates seamlessly with Kubernetes and Docker container orchestration platforms. This update marks a significant milestone in advancing container technology and strengthening container security.