Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation.
The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It further enhances performance and security via direct-device hardware passthrough for GPUs and high-performance networking using SR-IOV and vhost-user.
The runtime covers a broad range of capabilities, including guest operating system image engineering, the coordination of sandbox resources, and advanced monitoring and observability via distributed request tracing and guest console access. It also implements performance optimizations such as template-based VM cloning for accelerated boot times and memory access optimization through direct access filesystem features.
The system supports cross-architecture execution across x86, ARM, Power, and IBM Z hardware, with configuration managed through TOML files.
