2

Kata containers is trying to make containers secure by providing more isolation.

lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.

If I am building a playground/code fiddle (something like ideone), are they secure enough to compile and run untrusted code?

Is this a good/intended use for this type of containers?

Rico
  • 58,485
  • 12
  • 111
  • 141
someone
  • 300
  • 1
  • 9

2 Answers2

2

Any type of workload can potentially be used by Kata Containers, just like regular containers. The idea behind them is providing the VM isolation that you don't get with regular containers. You can use Kata Container with Docker and Kubernetes.

You can achieve a decent level of isolation with regular containers using things like seccomp, SELinux, Capabilities, and/or AppArmor but it can get quite complicated. Kata Containers offers a simpler alternative to that.

Rico
  • 58,485
  • 12
  • 111
  • 141
  • Do you know if it's possible to use Kata Containers with Azure Kubernetes Service? – Ryan Jun 28 '20 at 15:45
  • Not yet. it seems like they don't support the RuntimeClass yet. https://cloudblogs.microsoft.com/opensource/2020/04/03/kubernetes-v1-18-advances-windows-container-support/. You will need to manage your own control plane and use nested virtualization: https://azure.microsoft.com/en-us/blog/nested-virtualization-in-azure/ – Rico Jun 29 '20 at 13:49
1

It can be used but it's not the safest method.
I guess gVisor would be a better option to be used as a sandbox.
In Container Technology, the Host Operating System can be accessed from inside a container and it's not immune to outsiders' harmful manipulations.
Same thing is true for Virtual Machines and Hypervisors or Host Operating Systems. So it's safe to assume that same issues might be true for Kata Containers and the underlying Hypervisor.

Iman Ravakhah
  • 111
  • 1
  • 2
  • 5