4 ms·

In GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.

• dilyevsky 4y ago
  Yes except slow io
  • bogomipz 4y ago
    Can you elaborate? What type of I/O, network, disk? What is the issue exactly?
    • dilyevsky 4y ago
      You can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file-system https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls
      • bogomipz 4y ago
        Thanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?
        • dilyevsky 4y ago
          It does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think