4 ms·

The instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.

• bogomipz 4y ago
  I'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?
  • dilyevsky 4y ago
    Any untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that
    • bogomipz 4y ago
      In GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.
      • dilyevsky 4y ago
        Yes except slow io
        • bogomipz 4y ago
          Can you elaborate? What type of I/O, network, disk? What is the issue exactly?
          • dilyevsky 4y ago
            You can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file-system https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls
            • bogomipz 4y ago
              Thanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?
              • dilyevsky 4y ago
                It does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think