Kata Containers
Kata Containers is an open source project that implements lightweight virtual machines that feel and perform like containers, providing workload isolation and security advantages of VMs. It solves the security gap of traditional containers by running each container in its own VM. It is for developers and operators who need stronger isolation for multi-tenant or untrusted workloads.
✨ Key features
- Runs containers in lightweight VMs for hardware-level isolation
- Supports multiple architectures: x86_64, arm64, ppc64le, s390x
- Provides a runtime with containerd shimv2 implementation
- Includes a Rust-based runtime (runtime-rs) and optional built-in VMM (dragonball)
- Offers a check command to verify host capability
- Single configuration file for runtime, agent, and hypervisor
🎯 Use cases
- Run untrusted multi-tenant workloads with stronger isolation
- Secure container workloads on Kubernetes using kata-deploy
- Comply with security requirements needing VM-level isolation
- Test container workloads in a VM-like environment
- Build custom Kata Containers images and kernels with osbuilder
📦 Installation
🧰 Requirements: 64-bit system with virtualization support (Intel VT-x, AMD SVM, ARM Hyp, IBM Power, or IBM Z) and Linux.
For installation, see the installation guide in the repository. It includes release tarballs, kata-deploy Helm chart for Kubernetes, and build-from-source instructions.
🚀 Usage
To check if your host can run Kata Containers, run:
$ kata-runtime check
Add --no-network-checks to skip network checks, or --verbose for detailed output.
⚠️ Good to know
The project is under active development; platform support is limited to 64-bit systems with specific virtualization technologies.
❓ FAQ
What architectures are supported?
Kata Containers supports x86_64/amd64, aarch64/arm64, ppc64le, and s390x with respective virtualization technologies.
How do I check if my system can run Kata Containers?
Run kata-runtime check to perform a series of checks. Use --verbose for details and --no-network-checks to disable network checks.
What is the license?
The code is licensed under the Apache 2.0 license.
Where can I get help or report issues?
You can raise issues in the GitHub repository, and for security issues follow the vulnerability reporting process in SECURITY.md.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.