LoginSign Up
← Back to all sparks
K

Kata Containers

INFRA · APIS
Velocity3.8

Secure container runtime using lightweight virtual machines

katacontainers.io ↗

Kata rewrote its runtime in Rust and made it the default in 4.0.0

confidential-computingrust-rewritecontainer-runtimekubernetestdxsev-snp
◆Current state
Kata Containers ships monthly, and the 3.2x series was steady infrastructure work — confidential computing plumbing for TDX and SEV-SNP, s390x block and memory hotplug, GPU coldplug, vCPU pinning, and a long tail of CI and packaging fixes. That series was also quietly staging a replacement: nearly every release carries runtime-rs commits alongside the Go runtime. 4.0.0 completes the handover, shipping the Rust runtime as the default.
◆Where it's heading
Two long arcs converge here. The rewrite arc replaces a Go runtime with runtime-rs across x86_64, aarch64 and s390x and across QEMU, Cloud Hypervisor and Dragonball, bringing a new block storage model with it. The confidential-computing arc — TDX ACPI support, SNP protection, Trustee attestation, measured-rootfs validation, guest memfd — is what the project is actually selling, and a memory-safe runtime is the natural foundation for a multitenant isolation boundary.
◆Prediction
Expect the 4.x line to focus on closing the configuration and behavior gaps the release notes acknowledge for users migrating off the Go runtime, rather than adding new hypervisor or architecture support immediately.

◆Recent moves

  1. 19d ago

    4.0.0 makes the Rust runtime-rs the default runtime

    ⚡ SPARK

    The destination the 3.2x series was building toward: the runtime is rewritten from Go to Rust and runtime-rs becomes the default. It ships with x86_64, aarch64 and s390x support, QEMU, Cloud Hypervisor and Dragonball hypervisors, and a modernized block device model, with the project noting configuration and behavior differences for existing users.

    View source ↗
  2. 1mo ago

    3.32.0 adds TDX ACPI boot, guest memfd and QEMU NUMA support

    The last release before the Rust handover, and it reads like final staging: Dragonball gains a basic ACPI implementation for TDX boot and KVM-managed guest memfd, the agent gets NUMA support under QEMU, and the kernel enables the landlock LSM. runtime-rs picks up erofs snapshotter support with gpt vmdk mode.

    View source ↗
  3. 2mo ago

    3.31.0 brings coldplug GPU support and deployment health probes

    runtime-rs gains coldplug GPU support and CCW network hotplug on s390x, while kata-deploy adds healthz and readyz HTTP probes and reduces memory consumption. Several genpolicy fixes tighten path matching and empty environment variable handling.

    View source ↗
  4. 3mo ago

    3.30.0 sets QEMU as the runtime-rs default and adds vCPU pinning

    A meaningful step in the handover: QEMU becomes the default hypervisor for runtime-rs, which gains vCPU thread pinning. Dragonball implements a userspace IOAPIC to enable split irqchip, and the kernel picks up the configs needed for CIFS.

    View source ↗
  5. 3mo ago

    3.29.0 tightens genpolicy validation and adds an eBPF debug kernel

    Policy generation gets better emptyDir storage options and mount point validation, static tarball builds gain a debug kernel with eBPF configs, and a batch of security fixes lands. Documentation moves to mkdocs-material, which matters for a project whose deployment story is this configuration-heavy.

    View source ↗
  6. 4mo ago

    3.28.0 adds s390x block and memory hotplug plus SNP hardening

    Mainframe support advances with block device hotplug and virtio-mem memory hotplug on s390x, while runtime-rs enhances QEMU/SNP protection and sev-snp becomes required CI. GPU work continues with HGX Bx00 kernel enablement.

    View source ↗