Kata Container - The Security of VM and The Speed of Container | Yuntong Jin

1. Kata Containers
The speed of containers, the security of VMs
Jin, Yuntong
Intel Open Technology Center

2. Agenda
 Linux Containers Overview
 Container VS VM
 Kata Container Project Overview
 Kata Container Architecture and Design
 Kata Container Use Case

4. Linux* Containers Definition(s)
● LXC (Linux* Containers) is an operating-system-level virtualization method for running multiple
isolated Linux systems (containers) on a control host using a single Linux kernel. – Wikipedia
(https://en.wikipedia.org/wiki/LXC)
● Linux containers keep applications and their runtime components together by combining
lightweight application isolation with an image-based deployment method. Containers package
applications with the files on which they depend. This reduces the friction between development
and operations, simplifies application deployment, and accelerates delivery cycles--allowing you
to deliver value to customers faster. – Red Hat* (https://www.redhat.com/en/insights/containers)

5. Containers Use Linux* Kernel Technologies
Namespaces
MN
T
IPC
NET
PID UTS
Isolated networking
namespace for each
container instance
Control Groups
blkio
Device
s
Memory
CP
U
Assign, limit and monitor
system resources for each
container instance
Advanced File Systems
Fast root files system
creation and layered
changes
btrfs
AUFS
Device
Mapper
UnionFS
User Space
Kernel Space
Container Engine
Container Container Container Container Container Container Container
*Other names and brands may be claimed as the property of others

7. Containers and Virtual Machines
Source: http://www.rightscale.com/blog/cloud-management-best-practices/docker-vs-vms-combining-both-cloud-portability-nirvana

8. Containers Compared to Virtual Machines
Source: http://searchnetworking.techtarget.com/feature/Container-networking-offers-opportunity-to-simplify-networks

9. Containers and Virtual Machines
 Containers and Virtual Machines are not Mutually Exclusive
 Containers in Virtual Machines
The containers can be created/destroyed on multiple VMs and the VMs can migrate between physical
servers using existing VM infrastructure (e.g., OpenStack*)
 Virtual Machines in Containers
Make use of resource management technologies (kernel: c groups, namespaces)
Make use of build and deployment tools (simple Container creation syntax, Container infrastructure)
*Other names and brands may be claimed as the property of others

10. Container Concerns
● Security
Isolation from malicious neighbors
● Compatibility
Application compatibility with kernel versions
● Networking
Support for massive interconnectivity
● Maturity
Completeness of infrastructure, Compatibility and Interoperability in ecosystem

12. Tradition Containers
App A
Middleware
A
App B
Middleware B
App C
Middleware C
Server Hardware
Container A Container B Container C
Linux * Kernel

13. Kata Container - Hypervisor Based Containers
App A
Middleware A
Linux* Kernel
Server Hardware
Container A Container B Container C
Linux Kernel A
Virtual Machine
App B
Middleware B
Linux Kernel B
Virtual Machine
App C
Middleware C
Linux Kernel C
Virtual Machine
● Each container/pod is
hypervisor isolated
● As secure as a VM
● As fast as a container
● OCI spec compatible
● Seamless integration with
the container ecosystem
and management layers
● No need any changes for
container images

14. Kubelet
Container Runtime Interface (CRI)
CRI-O
runc kata-runtime
Pod
VM
Pod
CRI-O and Kata Containers

15. History
Intel® Clear Containers
May 2015 Dec 2017 *Other names and brands may be claimed as the property of others.
*

16. Technical Vision
 Light and fast VM-based containers
 OCI compatible container runtime
 No need container images changes
 Seamless integration with Kubernetes (CRI), Docker and OpenStack
 Seamless integration with all major networking plugins
 Support multiple architectures (x86, ARM, System Z, Power)
 Support multiple hypervisors (KVM/QEMU, Firecracker, ACRN)

17. Non-Technical Goals
*Other names and brands may be claimed as the property of
others.
 Open and vendor-neutral project
 All VM based containers, users and consumers under the same project
 Managed at the OpenStack Foundation*
 Independent from the OpenStack* software project

18. Kata Containers
Architecture and Design

20. Hypervisor
Shim
Proxy
Agent
Kernel
Virtual Machine
Runtime
I/O OCI cmd/spec
gRPC over Yamux
gRPC gRPC
Shim
Container namespaces
Container
Command
Container
Exec
Hypervisor serial interface

21. Hypervisor
Shim Agent
Kernel
Virtual Machine
Runtime
I/O OCI cmd/spec
gRPC
gRPC
Shim
Container namespaces
Container
Command
Container
Exec
Hypervisor VSOCK socket
*Other names and brands may be claimed as the property of
others.

22. Linux
Bridge
Kata Container Networking
Virtual Machine
Pod
Tap
Container networking namespace
Kubernetes*
Overlay
Network
veth pair
tc
mirror
*Other names
and brands
may be
claimed as the
property of
others.
MacVTAP

23. Kata Container Storage
Virtual Machine
Container 1
Rootfs
Overlay
Container 2
Rootfs
Overlay
9pfs/virtio-blk/virtio-fs
9pfs/virtio-blk/virtio-fs
9pfs/virtio-
blk/virtio-fs
9pfs/virtio-
blk/virtio-fs
Container 1
Volume
Container 2
Volume

24. 1
4
3
2
7
6
5
8

26. More Security
+
Flexibility
Regulated and sensitive
production environments
Mixed workloads
production
environments
Multi-tenant container
clusters
Bare metal
infrastructure
Legacy and cutting edge workloads with
kernel-dependent features

27. Multi-tenant Kubernetes*
k8s k8s
IaaS
container
container
Pod
VM
container
container
Pod
VM
container
container
Pod
VM
container
container
Pod
VM
CaaS
Pod
VM
k8s
Pod
VM
Pod
VM
Pod
VM
Pod
VM
Pod
VM
Pod
VM
Pod
VM
*Other names and brands
may be claimed as the
property of others.

29. Key Points
 Kata Containers is a security container with VM isolation.
 Seamless integration with Docker and Kubernetes.
 Open source project under OpenStack Foundation, vendor-neutral.
 Support multi Virtualization and platform, actively community.
 Maturity, product ready, deployed widely.

30. More information about Kata
 Source code:
Kata Containers: https://github.com/kata-containers
 Documentation:
Kata getting started: https://github.com/kata-containers/documentation/wiki/Developer-Guide
Kata Design requirements: https://github.com/kata-containers/documentation/blob/master/design/kata-design-requirements.md
Clear containers architecture: https://github.com/clearcontainers/runtime/blob/master/docs/architecture/architecture.md
 White papers and blogs:
Clear Containers custom kernel per pod: https://asciinema.org/a/146888
Clear Containers and Kubernetes: https://medium.com/cri-o/intel-clear-containers-and-cri-o-70824fb5181
More coming from katacontainers.io

31. Get involved in Kata community
 Code and documentation hosted on https://github.com/kata-containers/
 Major releases managed through Github* Projects
 Apache 2 license
 Slack: katacontainers.slack.com
 IRC: #kata-dev@freenode
 Mailing-list: kata-dev@lists.katacontainers.io

32. Thank you!

33. Notices and Disclaimers
● No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this
document.
● Intel disclaims all express and implied warranties, including without limitation, the implied warranties of
merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from
course of performance, course of dealing, or usage in trade.
● Intel technologies’ features and benefits depend on system configuration and may require enabled hardware,
software or service activation. Performance varies depending on system configuration. No computer system can
be absolutely secure. Check with your system manufacturer or retailer or learn more.
● The products described may contain design defects or errors known as errata which may cause the product to
deviate from published specifications. Current characterized errata are available on request.
● Intel, the Intel logo are trademarks of Intel Corporation or its subsidiaries in the U.S. and/or other countries.
● *Other names and brands may be claimed as the property of others.
● ©2019 Intel Corporation