OpenStack Launches Kata Containers Project To Improve Security

The OpenStack Foundation announced a new effort called Kata Containers on Dec. 5, in a bid to help organizations deploy and run containers more securely in the cloud.

The Kata Containers project is going to be run as a separate project from the main OpenStack cloud platform, with its own governance and project direction. At the core of Kata Containers are code contributions from Intel with Clear Containers and Hyper with runv.

Other companies that are supporting the project at launch include: 99cloud, AWcloud, Canonical, China Mobile, City Network, CoreOS, Dell/EMC, EasyStack, Fiberhome, Google, Huawei, JD.com, Mirantis, SUSE, Tencent, Ucloud and ZTE.

OpenStack Kata Containers

“The Kata Containers project is very much focused on technology at the infrastructure level that fills gaps for organizations trying to run containers securely in production,” Jonathan Bryce, Executive Director of the OpenStack Foundation told eWEEK.

Intel had been developing its’ open-source Clear Containers technology since 2015 as a way to help provide a base-layer hypervisor on which a container runtime can operate. Among the early backers of Clear Containers was CoreOS which uses the technology as part of its rkt container runtime. Hyper has been building a complementary effort called runv, which is intended to be a hypervisor based runtime for Open Container Initiative (OCI) compliant container technologies.

Bryce noted that there are two approaches to running container workloads, either to run the container natively on a server operating system, or to run it inside of a virtual machine hypervisor, to provide an additional layer of isolation. The challenge has been that with a full virtual machine hypervisor, there is additional resource overhead which can impact performance.

“Kata Containers is creating a middle ground with a very lightweight virtualization layer that the container runs in and that enables users to have isolation and security,” Bryce said. “It is so small and lightweight that it’s able to have very fast startup times and has minimal additional overhead.”

James Kulina, Chief Operating Officer at Hyper told eWEEK that his company had been talking with Intel for over a year about collaborating on the secure container project. He noted that Intel’s Clear Containers and Hyper’ runV were similar efforts.

“We have already been merging code for a base that enables the Kata launch,” Kulina said.

Kulina explained that Kata reworks the virtualization layer, so instead of putting in a full operating system which is normally what a traditional hypervisor does, Kata uses a stripped down kernel that enables the container to launch and run. The actual virtual machine technology that is being used for Kata is the open-source KVM hypervisor.

Kulina noted that the plan is to add support for other hypervisors in Kata, including the open-source Xen hypervisor. Kata is not going to be supporting VMware’s hypervisor, which has its own approach to running containers known as vSphere Integrated Containers.

Linux vendor Canonical has also had its’ own open-source project for a container hypervisor called LXD that first debuted back in 2014. Bryce noted that LXD is different than Kata in multiple ways.

“Kata is entirely focused on container workloads, it’s an execution environment for containers and is not meant to run an entire virtual machine,” Bryce said.

OpenStack

Supporting containers technology is not a new thing for OpenStack. The OpenStack cloud platform already has multiple container projects including Magnum for Kubernetes orchestration and Zun for launching and managing containers. Bryce explained that Kata is set to be supported in Zun, with users being able to directly create a Kata container from Zun.

He added that with Magnum, a cloud operator could create a Kubernetes environment that runs a Kubernetes pod inside of Kata containers.

Though Kata can work with other OpenStack projects, it is being run as an independent project, with its own governance and technical leadership drawn from the contributor base. Kata will also have usefulness beyond just OpenStack as well.

“OpenStack users will be able to benefit from the Kata technology, but there are many other use-cases that are outside of OpenStack cloud where container security is really important,” Bryce said.

Originally published on eWeek