Kata Containers Secure Runtime

This open-source container runtime combines the isolation and security advantages of virtual machines with the speed and simplicity of containers, providing hardware-isolated container execution environments. Created by Intel and Hyper.sh in 2017 and governed by the OpenInfra Foundation, the project has over 5,800 stars as of 2026. Key features include: VM-level isolation (each container or pod runs inside a lightweight virtual machine, providing hardware-enforced isolation from the host and other containers, preventing container escapes and kernel exploits), OCI compatibility (full Open Container Initiative runtime spec compliance, functioning as a drop-in replacement for runc in Docker, Kubernetes, and containerd), lightweight VMs (using optimized hypervisors including QEMU and Cloud Hypervisor, with VMs starting in milliseconds and minimal overhead), Kubernetes integration (deploying as a RuntimeClass, with each pod running in its own VM for maximum isolation), hardware acceleration (Intel VT-x and AMD-V for hardware-assisted virtualization, Intel VT-d and AMD IOMMU for device passthrough), multiple hypervisor support (QEMU, Cloud Hypervisor, Firecracker, and ACRN for different performance and isolation requirements), image support (pulling and running OCI container images including Docker Hub and private registries), volume and storage (block device passthrough, virtio-fs for shared file systems, and 9p for basic file system sharing), networking (TC filter, veth pairs, macvtap, and IP alias-based networking with CNI integration), confidential containers (integration with hardware-based Trusted Execution Environments including Intel SGX, AMD SEV-SNP, and ARM CCA for encrypted VM memory), and monitoring (Prometheus-compatible metrics for VM lifecycle, resource usage, and hypervisor performance).