Kata Containers: Virtual Machines that feel and perform like containers

Re:Kata Containers: Virtual Machines that feel and perform l... by theaiquestion on Monday July 17, 2023 @12:34PM (#36760324)

Depending on your use case there's potentially negligible startup time. On the scale of single digit seconds to less then half a second depending on how much work you put into optimizing it. For some applications this will be too slow (mainly the type where you boot a container per request, although flyio seems to make it work), I think for a _lot_ of applications this wouldn't be noticed.

Kata gives you a few different options for what/how you'd like to boot including firecracker.

This isn't exclusive to firecracker but if you stay lightweight you can have vm's booting under a half second if you're using slim images.

https://jvns.ca/blog/2021/01/23/firecracker--start-a-vm-in-l...

I honestly think for a lot of people, vm's with the convenience/orchestration tools of containers make more sense for a lot of general use cases simply because of the security benefits. The convenience still needs some work though.

[ Parent | on HN ]

Re:Kata Containers: Virtual Machines that feel and perform l... by insanitybit on Monday July 17, 2023 @02:08PM (#36761815)

Unless you're dealing with a multi-tenant situation I'm not super convinced that a VM is worth the effort. It's not the perf, it's the need to make your kernel, root file system, and other infra needed to make it all work.

Compare that to a docker container where there's basically 0 additional work that has to be done to be up and running.

For most cases I'd be really tempted to work on hardening the docker container than on setting up a VM. Things like Apparmor and seccomp in particular would likely go a very long way.

[ Parent | on HN ]