{"id":105291,"date":"2022-10-12T03:36:45","date_gmt":"2022-10-12T01:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-kata-containers-3-0-s-izolyacziej-na-osnove-virtualizaczii"},"modified":"2022-10-12T03:36:45","modified_gmt":"2022-10-12T01:36:47","slug":"vypusk-kata-containers-3-0-s-izolyacziej-na-osnove-virtualizaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-kata-containers-3-0-s-izolyacziej-na-osnove-virtualizaczii","title":{"rendered":"Release of Kata Containers 3.0 with virtualization-based isolation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

After two years of development, the release of Kata Containers 3.0 has been published, advancing the stack for running containers using full-fledged virtualization mechanisms for isolation. The project was created by Intel and Hyper by merging Clear Containers and runV technologies. The code is written in Go and Rust and is distributed under the Apache 2.0 license. The project is overseen by a working group established under the independent OpenStack Foundation, which includes companies such as Canonical, China Mobile, Dell\/EMC, EasyStack, Google, Huawei, NetApp, Red Hat, SUSE, and ZTE. <\/p>\n

The core of Kata is a runtime that enables the creation of compact virtual machines running with a full hypervisor instead of traditional containers that use a shared Linux kernel and are isolated through namespaces and cgroups. The use of of virtual machines<\/a> provides a higher level of security, protecting against attacks resulting from the exploitation of vulnerabilities in the Linux kernel. <\/p>\n

Kata Containers is geared towards integration into existing container isolation infrastructures with the possibility of using such virtual machines to enhance the security of traditional containers. The project provides mechanisms to ensure compatibility of lightweight virtual machines with various container isolation infrastructures, container orchestration platforms, and specifications such as OCI (Open Container Initiative), CRI (Container Runtime Interface), and CNI (Container Networking Interface). Tools for integration with Docker, Kubernetes, QEMU, and OpenStack are available. <\/p>\n

\"Release<\/center> <\/p>\n

Integration with container management systems is achieved through a layer that simulates container management, which accesses the controlling agent in the virtual machine through a gRPC interface and a special proxy. Inside the virtual environment, which is launched by the hypervisor, a specially optimized Linux kernel is used, containing only the minimum set of necessary features. <\/p>\n

Dragonball Sandbox (a KVM-based hypervisor optimized for containers) is supported as the hypervisor, along with QEMU tools, Firecracker, and Cloud Hypervisor. The environment includes an initialization daemon and an agent. The agent facilitates the execution of user-defined container images in OCI format for Docker and CRI for Kubernetes. When used with Docker, a separate environment is created for each container. the virtual machine<\/a>, meaning that the environment running on top of the hypervisor is used for nested container execution.

\"Release<\/center> <\/p>\n

To reduce memory usage, the DAX mechanism (direct access to the file system bypassing the page cache without using block device levels) is applied, while the KSM (Kernel Samepage Merging) technology is used for deduplicating identical memory regions, allowing for resource sharing of the host system and connecting a shared template of the environment to different guest systems. <\/p>\n

In the new version: <\/p>\n