eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The OpenStack Foundation announced a new effort called Kata Containers on Dec. 5, in a bid to help organizations deploy and run containers more securely in the cloud.
The Kata Containers project will be run as a separate project from the main OpenStack cloud platform, with its own governance and project direction. At the core of Kata Containers are code contributions from Intel with Clear Containers and Hyper with runV. Other companies supporting the project at launch include 99cloud, AWcloud, Canonical, China Mobile, City Network, CoreOS, Dell/EMC, EasyStack, Fiberhome, Google, Huawei, JD.com, Mirantis, SUSE, Tencent, Ucloud and ZTE.
“The Kata Containers project is very much focused on technology at the infrastructure level that fills gaps for organizations trying to run containers securely in production,” Jonathan Bryce, executive director of the OpenStack Foundation, told eWEEK.
Intel had been developing its open-source Clear Containers technology since 2015 as a way to help provide a base-layer hypervisor on which a container runtime can operate. Among the early backers of Clear Containers was CoreOS, which uses the technology as part of its rkt container runtime. Hyper has been building a complementary effort called runV, which is intended to be a hypervisor-based runtime for Open Container Initiative (OCI)-compliant container technologies.
There are two approaches to running container workloads: either run the container natively on a server operating system or run it inside of a virtual machine hypervisor to provide an additional layer of isolation, according to Bryce. The challenge has been that with a full virtual machine hypervisor, there is additional resource overhead, which can impact performance.
“Kata Containers is creating a middle ground with a very lightweight virtualization layer that the container runs in and that enables users to have isolation and security,” he said. “It is so small and lightweight that it’s able to have very fast startup times and has minimal additional overhead.”
James Kulina, chief operating officer at Hyper, told eWEEK that his company had been talking with Intel for over a year about collaborating on the secure container project. He noted that Intel’s Clear Containers and Hyper’s runV were similar efforts.
“We have already been merging code for a base that enables the Kata launch,” Kulina said.
Kulina explained that Kata reworks the virtualization layer, so instead of putting in a full operating system, which is normally what a traditional hypervisor does, Kata uses a stripped-down kernel that enables the container to launch and run. The actual virtual machine technology used for Kata is the open-source KVM hypervisor. The plan is to add support for other hypervisors in Kata, including the open-source Xen hypervisor, he said. Kata won’t support VMware’s hypervisor, which has its own approach to running containers known as vSphere Integrated Containers.
Linux vendor Canonical also has its own open-source project for a container hypervisor called LXD, which debuted in 2014. Bryce noted that LXD is different from Kata in multiple ways.
“Kata is entirely focused on container workloads; it’s an execution environment for containers and is not meant to run an entire virtual machine,” he said.
OpenStack
Supporting container technology is not a new thing for OpenStack. The OpenStack cloud platform already has multiple container projects, including Magnum for Kubernetes orchestration and Zun for launching and managing containers. Kata is set to be supported in Zun, with users being able to directly create a Kata container from Zun, according to Bryce. With Magnum, he added, a cloud operator could create a Kubernetes environment that runs a Kubernetes pod inside of Kata containers.
Although Kata can work with other OpenStack projects, it is being run as an independent project, with its own governance and technical leadership drawn from the contributor base. Kata will also have usefulness beyond just OpenStack.
“OpenStack users will be able to benefit from the Kata technology, but there are many other use cases that are outside of OpenStack cloud where container security is really important,” Bryce said.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.