Kata Containers – The speed of containers, the security of VMs

They don&#x27;t seem to have written any code yet. [1] So what we have at this point is a marketing website about their ambition and goals?<p>[1]<a href="https:&#x2F;&#x2F;github.com&#x2F;kata-containers&#x2F;runtimes" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;kata-containers&#x2F;runtimes</a>

Impressive backing by the big name companies.<p>The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD?<p>On the other hand, isn&#x27;t this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I always thought clear Linux was a Intel playground for proof-of-concept which will eventually be up streamed to major Linux distributions.Is it not true?<p>I guess my question is why a separate project like this, instead of RedHat Enterprise Containers or Debian containers?

One thing that isn&#x27;t mentioned on front page at least is the management aspect.<p>Docker became popular because it was pretty easy to use, and to publish and reuse existing containers. Whatever competes with it only stands a chance if it can either reuse the existing container ecosystem, or offer something roughly as good.

The British Indian Ocean territory really is becoming a tech hub.

How is this better than using rkt with an lkvm stage1[1], which also uses the work done by the Clear Containers team? It looks like Kata packages QEMU as well, which seems a bit overkill.<p>[1]<a href="https:&#x2F;&#x2F;coreos.com&#x2F;rkt&#x2F;docs&#x2F;latest&#x2F;running-kvm-stage1.html" rel="nofollow">https:&#x2F;&#x2F;coreos.com&#x2F;rkt&#x2F;docs&#x2F;latest&#x2F;running-kvm-stage1.html</a>

It&#x27;s kind of interesting that it&#x27;s only in the Linux world that containers cannot be thought of as isolated or secure. Seeing it from a jails and zones perspective, rather sad, actually :)

Another alternative is using hyper container

&gt; <i>It is designed to be architecture agnostic, run on multiple hypervisors and be compatible with the OCI specification for Docker containers</i><p>In what sense is this &quot;OCI compatible&quot;? Do they implement the runtime, image format spec, or both? My understanding of containerization and OCI runtimes is that they&#x27;re fundamentally different from hardware-level virtualization.

Whats the difference between unikernels and kata containers?