Kata Con­tain­ers: Se­cure Con­tain­ers from the OpenS­tack Com­mu­nity

Kata Con­tain­ers is new con­tainer tech­nol­ogy that com­bines tech­nol­ogy from In­tel Clear Con­tain­ers with runV from Hyper. Man­aged by a com­mu­nity, the ob­jec­tive of Kata is to de­liver speed and se­cu­rity.

OpenSource For You - - Contents - By: Swap­nil Kulka­rni The au­thor is an open source en­thu­si­ast with ex­pe­ri­ence in blockchain tech­nolo­gies, cloud na­tive so­lu­tions, con­tain­ers and en­ter­prise soft­ware prod­uct ar­chi­tec­tures. He blogs at cloud­na­tivetech.word­press.com.

Ever since Linux con­tain­ers were launched with Docker, con­tainer­i­sa­tion has be­come a full-fledged do­main. Con­tain­ers are now used in a num­ber of ap­pli­ca­tions and, as in the case of all de­vel­op­ing tech­nolo­gies, real-life chal­lenges linked to per­for­mance and se­cu­rity have be­gun to mat­ter with con­tain­ers as well.

In­tel has been work­ing on the Clear Con­tain­ers Project for some time to ad­dress se­cu­rity con­cerns within con­tain­ers through In­tel Vir­tu­al­iza­tion Tech­nol­ogy (In­tel VT). This es­sen­tially of­fers the ca­pa­bil­ity to launch con­tain­ers as light­weight vir­tual ma­chines (VMs), pro­vid­ing an al­ter­na­tive run­time, which is in­ter­op­er­a­ble with pop­u­lar con­tainer en­vi­ron­ments such as Ku­ber­netes and Docker. At the same time, the Hyper com­mu­nity has been work­ing on pro­vid­ing the al­ter­nate OCI-com­pli­ant run­time to run con­tain­ers on hy­per­vi­sors, with a few lim­i­ta­tions caused by the cur­rent in­com­pat­i­bil­ity be­tween hy­per­vi­sors and con­tain­ers.

In re­cent times, it’s been no­ticed that sin­gle ven­dor open source projects and com­mu­ni­ties do not at­tract many con­trib­u­tors due to their in­her­ent ven­dor-spe­cific poli­cies. There has al­ways been a need for an open source com­mu­nity to build these projects up, along with the cur­rent set of con­trib­u­tors, and drive fur­ther col­lab­o­ra­tive in­no­va­tion.

Dur­ing the last KubeCon, OpenS­tack Foun­da­tion an­nounced a new ini­tia­tive aimed at uni­fy­ing the speed and man­age­abil­ity of con­tain­ers with the se­cu­rity ad­van­tages of vir­tual ma­chines (VMs). This was called Kata Con­tain­ers.

What are Kata Con­tain­ers?

Kata Con­tain­ers is an open source project and com­mu­nity, work­ing to build a stan­dard im­ple­men­ta­tion of light­weight vir­tual ma­chines (VMs) that feel and per­form like con­tain­ers, but pro­vide the work­load iso­la­tion and se­cu­rity ad­van­tages of VMs. In­tel is con­tribut­ing In­tel Clear

Con­tain­ers tech­nol­ogy and Hyper is con­tribut­ing the runV tech­nol­ogy to ini­ti­ate the project. The Kata Con­tain­ers com­mu­nity will ini­tially merge both the tech­nolo­gies at their cur­rent state to pro­vide light and fast VM based con­tain­ers

An overview of the project

The Kata Con­tain­ers project will ini­tially com­prise six com­po­nents, in­clud­ing the agent, run­time, proxy, shim, ker­nel and pack­ag­ing of QEMU 2.9.The ini­tial set of projects is es­sen­tially based on projects from con­tribut­ing projects like Clear Con­tain­ers or runV. It is de­signed to be ar­chi­tec­ture ag­nos­tic, run on mul­ti­ple hy­per­vi­sors and be com­pat­i­ble with the OCI spec­i­fi­ca­tions for Docker con­tain­ers and CRI-O for Ku­ber­netes. For now, Kata will only run on chips based on the x86 ar­chi­tec­ture and will only sup­port KVM as its hy­per­vi­sor. The plan is to ex­pand sup­port to other ar­chi­tec­tures and hy­per­vi­sors over time.

For users, Kata Con­tain­ers does not yet pro­vide an in­stal­la­tion op­tion di­rectly. Users can ei­ther in­stall Clear Con­tain­ers or runV, since both projects will pro­vide a mi­gra­tion path to Kata Con­tain­ers at a later date.

The com­mu­nity

Kata Con­tain­ers is hosted on GitHub un­der the Apache 2 li­cence. While it will be man­aged by the OpenS­tack Foun­da­tion, it is an in­de­pen­dent project with its own tech­ni­cal gov­er­nance and con­trib­u­tor base. The Kata Con­tain­ers project is gov­erned ac­cord­ing to the ‘four opens’— open source, open de­sign, open de­vel­op­ment and open com­mu­nity. Tech­ni­cal de­ci­sions will be made by tech­ni­cal con­trib­u­tors and a rep­re­sen­ta­tive ar­chi­tec­ture com­mit­tee. The com­mu­nity also has a work­ing com­mit­tee to make non-tech­ni­cal de­ci­sions and help in­flu­ence the project’s over­all strat­egy, in­clud­ing mar­ket­ing, com­mu­ni­ca­tions, prod­uct man­age­ment and ecosys­tem sup­port.

Con­tribut­ing to Kata Con­tain­ers

Kata Con­tain­ers is work­ing to build a global, di­verse and col­lab­o­ra­tive com­mu­nity. If you are in­ter­ested in sup­port­ing the tech­nol­ogy, you are wel­come to par­tic­i­pate. There is a re­quire­ment for con­trib­u­tors with dif­fer­ent ex­per­tise and skills, rang­ing from de­vel­op­ment, op­er­a­tions, doc­u­men­ta­tion, mar­ket­ing, com­mu­nity or­gan­i­sa­tion and prod­uct man­age­ment. You can learn more about the project at kat­a­con­tain­ers.io, or view the code repos­i­to­ries on GitHub to con­trib­ute to the project. You can also talk to fel­low con­trib­u­tors on Freen­ode IRC: #kata-dev or Kata Con­tain­ers Slack or sub­scribe to the kata-dev mail­ing list.


[1] https://www.opens­tack.org/foun­da­tion/ [2] https://kat­a­con­tain­ers.io/ [3] https://github.com/kata-con­tain­ers [4] https://bit.ly/KataSlack [5] http://lists.kat­a­con­tain­ers.io/cgi-bin/mail­man/listinfo

Newspapers in English

Newspapers from India

© PressReader. All rights reserved.