4 ms·
kata containers were demonstrated to me in 2018. So they are not that new. I had forgotten about them in the meantime. Is there a good reason why they don't se
by usr1106 3y ago
kata containers were demonstrated to me in 2018. So they are not that new. I had forgotten about them in the meantime.
Is there a good reason why they don't seem widely adopted?
- supriyo-biswas 3y agoAmazon’s Firecracker, another project with similar goals, has seen a lot of adoption however.
- goku12 3y agoTo add, firecracker is an alternative to qemu like katacontainers are an alternative to containerd or runc. But both focus of security by isolation, as you mentioned.
- pjmlp 3y agoAzure has a similar approach available as option.
- galangalalgol 3y agoIs this related to kata os at all?
- cpach 3y agoNo.
- insanitybit 3y ago> Is there a good reason why they don't seem widely adopted? TBH their docs aren't that great. There should probably be a 'curl | sh' solution to install it at the top of the readme followed by a '<run this command and you're in an ubuntu shell in kata!>' command right after. Another issue is the lack of nested virtualization in EC2 instances that aren't the very expensive i3 metals. That turns this from a "it's a drop in replacement" to "I'm spending thousands of dollars on this".
- PurelyApplied 3y agoThere should be a `curl | sh` in this, a security-oriented product? To demonstrate how badly you need it, perhaps? Please don't pipe the Internet directly into your command line.
- HL33tibCe7 3y agoAh yes, because using a package manager to pipe the internet directly into our computer instead is so much better.
- nicce 3y agoYes. Proper package manager usually proceeds to install only signed packages. It means that usually OS maintainer has verified the purpose of the package. It gives a quite lot more trust than running arbitrary content as shell script, without any third party verification.
- HL33tibCe7 3y agoVerified using a public key that you acquire over HTTPS, the exact same channel that you trust with curl | sh
- nicce 3y agoFrom above: > , without any third party verification. Certificate provider does not verify packages nor anything what is coming from there. Server even might be just proxy.
- HL33tibCe7 3y agoThe exact same problem exists with the channel that you acquire the public key you trust from. You’re still fundamentally trusting HTTPS to the package provider - you’re just trusting it at a different point.
- rwmj 3y agoThe ideal situation is you would never know you are using them, they'd just work as an extra security layer. I think they're quite a ways off doing this.