kata-containers
kubevirt
Our great sponsors
kata-containers | kubevirt | |
---|---|---|
11 | 50 | |
4,768 | 5,003 | |
3.6% | 2.6% | |
10.0 | 10.0 | |
about 10 hours ago | 6 days ago | |
Rust | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
kata-containers
- Maestro: A Linux-compatible kernel in Rust
-
Fly Kubernetes
Seems like Fly.io Machines are trying reimplement Kata Containers with the Firecracker backend [0].
Kata has a guest image and guest agent to run multiple isolated containers [1].
[0] https://katacontainers.io/
[1] https://github.com/kata-containers/kata-containers/blob/main...
-
Kata Containers: Virtual Machines (VMs) that feel and perform like containers
If you install kata with https://github.com/kata-containers/kata-containers/blob/main...
Then you just use it with:
docker run --runtime io.containerd.kata.v2 --rm -it hello-world
Kara used “DAX” to directly share access of the host filesystem to the guest kernel. I thought this was pretty interesting, but it sounds like a possible spot to start a jailbreak.
> Mapping as a direct access device allows the guest to directly access the host memory pages (such as via Execute In Place (XIP)), bypassing the guest kernel's page cache. This zero copy provides both time and space optimizations.
> Mapping as a direct access device inside the VM allows pages from the host to be demand loaded using page faults, rather than having to make requests via a virtualized device (causing expensive VM exits/hypercalls), thus providing a speed optimization.
> Utilizing mmap(2)'s MAP_SHARED shared memory option on the host allows the host to efficiently share pages.
From https://github.com/kata-containers/kata-containers/tree/main...
> Last time I looked (a few months ago), the documentation was pretty sparse or outdated.
It still is, though it works somewhat seamlessly when installing with https://github.com/kata-containers/kata-containers/blob/main...
Though only one of the hypervisors works well.
-
Kata Containers vs gVisor?
As I understand,Kata Containers
-
Firecracker MicroVMs
Kubernetes using Kata containers as a containerd backend
https://github.com/kata-containers/kata-containers/blob/main...
-
Container security best practices: Ultimate guide
My home k8s cluster is now "locked down" using micro-vms (kata-containers[0]), pod level firewalling (cilium[1]), permission-limited container users, and mostly immutable environments. Given how quickly I rolled this out; the tools to enhance cluster environment security seem more accessible now than my previous research a few years ago.
I know it's not exactly a production setup, but I really do feel that it's the most secure runtime environment I've ever had accessible at home. Probably more so than my desktops, which you could argue undermines most of my effort, but I like to think I'm pretty careful.
In the beginning I was very skeptical, but being able to just build a docker/OCI image and then manage its relationships with other services with "one pane of glass" that I can commit to git is so much simpler to me than my previous workflows. My previous setup involved messing with a bunch of tools like packer, cloud-init, terraform, ansible, libvirt, whatever firewall frontend was on the OS, and occasionally sshing in for anything not covered.
-
Docker Without Docker
I'm really impressed by fly.io, and the candidness with which they share some of their really awesome technology. Being container-first is the next step for PaaS IMO and they are ahead of the pack.
I aim to build a platform like theirs someday (probably not any time soon) but I don't think I'd do any of what they're doing -- it feels unnecessary. Bear with me as I recently learned that they use nomad[0] and some of these suggestions are kubernetes projects but I'd love to hear why the following technologies were decided against (if they were):
- kata-containers[1] (it does the whole container -> VM flow for you, automatically, nemu, firecracker) with multiple VMM options[2]
- linuxkit[3] (let's say you didn't go with kata-containers, this is another container->VM path)
- firecracker-containerd[4] (very minimal keep-your-container-but-run-it-as-a-VM)
- kubevirt[5] (if you just want to actually run VMs, regardless of how you built them)
- Ceph[6] for storage -- make LVM pools and just give them to Ceph, you'll get blocks, distributed filesystems (CephFS), and object gateways (S3/Swift) out of it (in the k8s space Rook manages this)
As an aside to all this, there's also LXD, which supports running "system" (user namespace isolated) containers, VMs (somewhat recent[7][8]), live migration via criu[9], management/migration of underlying filesystems, runs on LVM or zfs[10], it's basically all-in-one, but does fall behind in terms of ecosystem since everyone else is aboard the "cloud native"/"works-with-kubernetes" train.
I've basically how I plan to run a service like fly.io if I ever did -- so maybe my secret is out, but I sure would like to know just how much of this fly.io got built on (if any of it), and/or what was turned down.
[0]: https://news.ycombinator.com/item?id=26745514
[1]: https://github.com/kata-containers/kata-containers
[2]: https://github.com/kata-containers/kata-containers/blob/2fc7...
[3]: https://github.com/linuxkit/linuxkit
[4]: https://github.com/firecracker-microvm/firecracker-container...
[5]: https://github.com/kubevirt/kubevirt
[7]: https://discuss.linuxcontainers.org/t/running-virtual-machin...
[8]: https://github.com/lxc/lxd/issues/6205
-
Checking Your --privileged Container
Kata Containers https://github.com/kata-containers/kata-containers
kubevirt
-
Kubernetes For The Sysadmin - Enter KubeVirt
First, download virtctl for ARM: https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0-alpha.0
-
Docker's deleting Open Source images and here's what you need to know
We are even using Docker Hub to store and distribute VM images...
https://github.com/kubevirt/kubevirt/blob/main/containerimag...
-
Blog: KWOK: Kubernetes WithOut Kubelet
Docker Desktop runs dockerd in a Linux VM with Apple's hypervisor framework. You can also run containers in a Linux VM with Parallels or VMware Fusion hypervisors. But you can't run VMs inside those VMs as it stands today. This works fine on Intel Macs which means you can't experiment and use KVM - one of the killer features of Linux and things like https://kubevirt.io/
-
Docker + portainer vs k8. EILI5
Proxmox VE can run VMs and LXC containers (see my comment below on LXC). Kubernetes can run OCI containers, but there's also KubeVirt for running VMs.
-
Live Switching Pods to another Node on Resource Limits
Another option would be something like KubeVirt but that is a different use case where you are actually running a VM in a container for hard-to-containerize workloads.
-
Crafting container images without Dockerfiles
It can, kubevirt is a project for running VMs https://kubevirt.io/ and there have been more esoteric things like WASM (https://github.com/krustlet/krustlet).
-
Why use something like proxmox over docker or podman?
Run kubernetes. Automatically clusters everything together. You CAN run VMs on kubernetes too. https://kubevirt.io/
- Is there any feature you wish Kubernetes had?
-
A future without containers? ( thoughts )
Perhaps for this reason we see that some orchestration systems (e.g. https://kubevirt.io/, https://fly.io/blog/docker-without-docker/ ) added support for virtual machines. And also more and more projects try to keep up with the Firecracker platform.
-
VMware Alternatives?
On the plus side if your company is good with kubernetes then everything becomes kubernetes based with harvester and rancher since a VM just becomes another kubernetes resource. This is the general direction that Rancher and Openshift are trying to move to to take on companies like vmware and even cloud solutions like openstack. If you would like to learn more about this check out the kubevirt project https://kubevirt.io/
What are some alternatives?
harvester - Open source hyperconverged infrastructure (HCI) software
firecracker-containerd - firecracker-containerd enables containerd to manage containers as Firecracker microVMs
lxd - Powerful system container and virtual machine manager [Moved to: https://github.com/canonical/lxd]
sysbox - An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.
k3s - Lightweight Kubernetes
gvisor - Application Kernel for Containers
cloud-hypervisor - A Virtual Machine Monitor for modern Cloud workloads. Features include CPU, memory and device hotplug, support for running Windows and Linux guests, device offload with vhost-user and a minimal compact footprint. Written in Rust with a strong focus on security.
crossplane - The Cloud Native Control Plane
ignite - Ignite a Firecracker microVM
cilium - eBPF-based Networking, Security, and Observability