9 ms·
Kata Containers: The speed of containers, the security of VMs
- usr1106 3y agokata containers were demonstrated to me in 2018. So they are not that new. I had forgotten about them in the meantime. Is there a good reason why they don't seem widely adopted?
- supriyo-biswas 3y agoAmazon’s Firecracker, another project with similar goals, has seen a lot of adoption however.
- goku12 3y agoTo add, firecracker is an alternative to qemu like katacontainers are an alternative to containerd or runc. But both focus of security by isolation, as you mentioned.
- pjmlp 3y agoAzure has a similar approach available as option.
- galangalalgol 3y agoIs this related to kata os at all?
- cpach 3y agoNo.
- insanitybit 3y ago> Is there a good reason why they don't seem widely adopted? TBH their docs aren't that great. There should probably be a 'curl | sh' solution to install it at the top of the readme followed by a '<run this command and you're in an ubuntu shell in kata!>' command right after. Another issue is the lack of nested virtualization in EC2 instances that aren't the very expensive i3 metals. That turns this from a "it's a drop in replacement" to "I'm spending thousands of dollars on this".
- PurelyApplied 3y agoThere should be a `curl | sh` in this, a security-oriented product? To demonstrate how badly you need it, perhaps? Please don't pipe the Internet directly into your command line.
- HL33tibCe7 3y agoAh yes, because using a package manager to pipe the internet directly into our computer instead is so much better.
- nicce 3y agoYes. Proper package manager usually proceeds to install only signed packages. It means that usually OS maintainer has verified the purpose of the package. It gives a quite lot more trust than running arbitrary content as shell script, without any third party verification.
- HL33tibCe7 3y agoVerified using a public key that you acquire over HTTPS, the exact same channel that you trust with curl | sh
- nicce 3y agoFrom above: > , without any third party verification. Certificate provider does not verify packages nor anything what is coming from there. Server even might be just proxy.
- HL33tibCe7 3y agoThe exact same problem exists with the channel that you acquire the public key you trust from. You’re still fundamentally trusting HTTPS to the package provider - you’re just trusting it at a different point.
- rwmj 3y agoThe ideal situation is you would never know you are using them, they'd just work as an extra security layer. I think they're quite a ways off doing this.
- TekMol 3y agoWhat I don't like about Docker is that it spews stuff all over the place. After installation, it is constantly running. As can be seen by: ps aux | grep docker And it occupies IPs: ip addr | grep I was on a train in Germany recently and could not use the Wifi because of that. Turned out the docker daemon occupied the IP range the Train Wifi uses. While I was not using docker at all. I guess it clutters even more stuff. Any suggestions what else to look for? So I am looking for a cleaner container solution. One that feels more like a Linux tool that keeps the system intact and only runs when it runs. If Kata is such a tool, I would look into it more closely.
- loloquwowndueo 3y agoSystemd-nspawn or LXD/Incus are also alternatives. LXD user experience is pretty good.
- leosanchez 3y agoI liked LXD from the limited time I spent on it. Do you know any resources to learn it a bit more in depth ?
- Grimburger 3y agoReading this makes me concerned as someone who loves LXD, because when you reflect on it there's not really that much for newcomers besides some blog posts or a "fail and ask on the forums" model which clearly isn't optimal for some learning styles. It's a probably a misstep by the linux containers ecosystem, I do hope Incus can improve on this.
- goku12 3y agoLXD official online documentation (now hosted by Canonical) is the sole resource I needed to set it up and use it. The CLI concepts and commands are designed well enough and is intuitive. The only outside resource I had to read was for some privileged containers running K8s inside.
- mezobeli 3y agoLXC does it better, you can even have virtualization
- goku12 3y agoThe difference here is that katacontainers are OCI and CRI complaint - meaning that it can immediately be used with K8s, Nomad and possibly others. You get all the features of these orchestration platforms. LXC doesn't have that (it actually predates OCI and CRI). There are other orchestration systems that can use LXC - LXD, libvirt, Proxmox, and may be others. Also, LXC doesn't have traditional virtualization - that's a feature of LXD using KVM. (Do you mean system containers, as opposed to regular app containers?)
- rascul 3y agoLXC ships with a template that can import OCI containers.
- raesene9 3y agoKata containers are a cool concept but can be a bit difficult to get started with. Last time I tried it the standalone Docker/containerd integration wasn't working well, the project seemed to be more targeting deployment as part of a k8s cluster.
- andrewstuart 3y agoQemu also has its microvm
- bittermandel 3y agoWe use Kata Containers to create Firecracker VMs from Kubernetes. Works really well for us. Though I am hoping there will be a more specific solution for Firecracker, as we don't need any other runtimes (which kind of ruins the purpose of Kata).
- boyd 3y agoI was looking at this a while back and it was difficult/tedious at the time (and I think also not supported on Amazon EKS). Has it gotten better? Any resources you recommend? Cursory Google searches on this have so much outdated info it can be hard to quickly wade back in.
- lacoolj 3y agoI looked into this months ago and found it wasn't very active. Has this changed?
- tambourine_man 3y agoHow are they accomplishing this? I glanced at the documentation but couldn’t find anything in this regard.
- rwmj 3y agoBy running the containers in VMs, and attempting to make the VMs boot very quickly by carefully tuning qemu (or Firecracker) and the guest kernel. The main problem with this approach is surprisingly not the time overhead - Kubernetes is fscking slow at scheduling regular containers - but the memory overhead, since you need to allocate sufficient memory up front for the largest possible memory usage of the container. Most containers expect to get more memory from the system simply by doing sbrk/mmap, and VMs simply don't work this way.
- suprjami 3y agoDoesn't KVM work that way? You can give a VM "up to" a certain amount of memory but it doesn't allocate all that memory at first boot. iiuc that's because each VM is just a process which can increase its own heap. It's explained in more detail here: https://serverfault.com/questions/773581/virt-manager-partioning-the-available-memory https://serverfault.com/questions/773581/virt-manager-partio...
- rwmj 3y agoNot really, no. The kernel has a certain overhead tracking pages and page tables, so adding extra memory and waiting for it to be swapped in isn't free. Plus you still have to account for the memory being used somehow. If you use cgroups - as is done most commonly - that will track the full memory allocated. Not to mention this would only solve half of the problem, you also have to think about what happens with munmap.
- suprjami 3y agoGood points, thank you for the explanation!
- ramon156 3y agoSomewhat that i'd love to see someone develop is mutagen support. Running docker on mac isn't very optimised, let alone enjoyable because of the amount of RW that's being done. Mutagen solves this nicely
- kosolam 3y agoWhat is the isolation mechanism in kata containers that make them on par with VMs?
- vladvasiliu 3y agoA hypervisor, such as KVM. See https://katacontainers.io/learn/ https://katacontainers.io/learn/
- kosolam 3y agoFrankly it’s a bit confusing. Some wrapper around qemu and firecracker. This is what I gathered from this link after 5 minutes of skimming.
- shantnutiwari 3y ago>Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. Ummm, so what do they do again? Sounds like marketing speak. "Like VMs but containers" doesnt tell me anything
- two_handfuls 3y agoHow is Kata safer than Docker?