Viewing profile — gbxk

Update: Katakate now supports ARM architecture (on Linux) thanks to a PR merged from Katakate's first external GitHub contributor: @spullara. Thank you!

Test passed, PR merged

As promised: https://github.com/Katakate/k7/tree/fix/no-dns-res-in-lockdo... Will merge that in after it passes all network tests on a clean/wiped instance.

Thanks! I'll review Arrakis and come back. E2B is often considered harder to setup and less AI engineers friendly for direct stack contributions, as Katakate is the only alternativ…

Thanks! Yes: Katakate provides much stronger isolation, since it uses hardware virtualization (via Kata Containers and Firecracker) while gVisor relies purely on software sandboxin…

Thanks for sharing, adding it to my list.

Very cool! Apple containers run on Apple ARM so it's complimentary to my stack which doesn't support ARM yet (but soon will when extending to Qemu which supports ARM). Thanks for s…

This is an excellent point. I moved this to #1 on the TODO list. I'll deny all DNS resolution by default until Cilium is integrated, if that passes the basic functionality tests. I…

Thanks, will study that one too!

Interesting, thanks for sharing!

Very cool one. That's dedicated to Apple ARM which I don't currently support so the two are complimentary. Apple containers shares some primitives with Kata. I'll investigate if it…

Thanks, I'll review that one too and compare.

Lucky you! And lucky me for sharing the info :)

Katakate is built on top of Kata, and sets up a stack combining Kubernetes (K3s), Kata, Firecracker, and devmapper snapshotter for thin pool provisioning. Combining these tools tog…

That's a config example. Yes, blocking DNS exfiltration requires DNS filtering at cluster level. This is what will be added with the Cilium integration which is top-3 on the roadma…

Thanks everyone for the amazing feedback and discussion! For anyone curious: – Docs: https://docs.katakate.org - LangChain Agent tutorial: https://docs.katakate.org/guides/langchai…

It uses Kata with Firecracker which gives you as light of a boot as it gets. Subsecond booting for instance is accessible with a lighter rootfs, which is also on the roadmap (one o…

That's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.

It is well known that containers do not provide you safe isolation. It is not their purpose. They share kernel and page cache with the host. Any kernel exploit gives to someone in …

Sure one day if it really kicks off I could think of offering additionally a SaaS solution with paid enterprise features like SOC 2 compliance, RBAC, multiple clouds supported, etc…

If you have any suggestion on how I can make this more friendly UX-wise to your personal usage, I am most interested to hear! And this will shape my roadmap.

Actually you can! After you run "k7 install" you'll have a k3s cluster up and running, with Kata as a runtime class, and Firecracker specified in Kata config. So nothing prevents y…

True! GCP does. I haven't tested it yet. I didn't know D.O does. If anyone knows others, I'm interested too!

No business model short-term. My goal is broad adoption, 100% open-source. By multi-node I mean so far I only support 1 k8s node, i.e. 1 machine, but soon adding support for multip…