Kata Containers – The speed of containers, the security of VMs
katacontainers.io
Kata Containers – The speed of containers, the security of VMs
1–10 of 76 posts
Re: Kata Containers – The speed of containers, the security of VMs
#2Impressive backing by the big name companies.
The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD?
On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I always thought clear Linux was a Intel playground for proof-of-concept which will eventually be up streamed to major Linux distributions.Is it not true?
I guess my question is why a separate project like this, instead of RedHat Enterprise Containers or Debian containers?
Re: Kata Containers – The speed of containers, the security of VMs
#3Another alternative is using hyper container
Re: Kata Containers – The speed of containers, the security of VMs
#4Another alternative is using hyper container
This is a combined work of the people behind Intel Clear containers and Hyper containers.
Re: Kata Containers – The speed of containers, the security of VMs
#5The British Indian Ocean territory really is becoming a tech hub.
Re: Kata Containers – The speed of containers, the security of VMs
#6Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…
> The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services
Are you saying that security and isolation is not enticing for ephemeral services? I know that an ephemeral container is reset after a restart but I think that it's a bit naive to think that that is a good enough replacement for true isolation.
Re: Kata Containers – The speed of containers, the security of VMs
#7Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…
Interesting that nearly half of the backers are Chinese companies.
Re: Kata Containers – The speed of containers, the security of VMs
#8Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…
> On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like?
At least Debian doesn't develop isolation solutions on its own; it tends to package software that's already out there. And if it's popular enough, it might be integrated fairly tightly into the distribution.
Re: Kata Containers – The speed of containers, the security of VMs
#9One thing that isn't mentioned on front page at least is the management aspect.
Docker became popular because it was pretty easy to use, and to publish and reuse existing containers. Whatever competes with it only stands a chance if it can either reuse the existing container ecosystem, or offer something roughly as good.
Re: Kata Containers – The speed of containers, the security of VMs
#10Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…
> The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services Are you saying that security and isolation is not enticing for ephemeral services? I know that an ephemeral container is reset after a restart but I think that it's a bit naive to think that that is a good enough replacement for true isolation.
> Are you saying that security and isolation is not enticing for ephemeral services?
Didn't mean to imply the reverse logic of my statement. I believe Linux Containers (and hence Docker) depend only on Kernel namespaces to provide isolation. In my admittedly naive eyes, they were not good enough/mature to replace my KVM VMs yet. Too much to trade off for little convenience/performance.
However, if Linux containers matured up and offered the same isolation facilities that something like KVM does, then I can think about switching to them in future, and enjoy the performance boost.
>I know that an ephemeral container is reset after a restart but I think that it's a bit naive to think that that is a good enough replacement for true isolation.
If I'm looking to run an application for which I care about solid isolation of resources, I'd spend my time running it as VM. But, if I'm running a one-time script that chews some data and I don't care much about it bothering other workloads in the system or other workloads bothering it, then I'd fall back on the isolation facilities offered by namespaces by using Containers. Nothing wrong with that.
Security view on these is another argument. If I can't afford the application escalating it's view and looking into other workloads in that system, I just wouldn't run them in Containers today.