Kata Containers Explained: Run Kubernetes Pods in MicroVMs

Kata Containers runs each Kubernetes pod in its own lightweight virtual machine (microVM) — so your pods get VM-level isolation with the normal container workflow: same kubectl, same images, same YAML. In this Kata Containers tutorial, you will learn how Kata works inside Kubernetes, how it compares with runc, how to install it with Helm, and when to use it for container security, multi-tenant clusters, CI runners, and AI agents. What you will learn: Why containers that share one Linux kernel are a security risk What Kata Containers is and how it isolates Kubernetes pods The runtime path: kubelet → containerd / CRI-O → containerd-shim-kata-v2 → hypervisor → pod VM Inside the pod VM: the kata-agent (Rust), ttRPC over vsock Hypervisors for Kata: QEMU, Cloud Hypervisor, Firecracker, Dragonball How files get into the VM: virtio-fs, and devmapper for Firecracker Kubernetes RuntimeClass: runtimeClassName: kata-qemu Install Kata with the kata-deploy Helm chart Demo: runc vs Kata — a different kernel in each pod Costs and limits: memory, pod start time, nested virtualization, no host network Security model: the VM boundary + agent policy (Rego) Confidential Containers (CoCo) with Intel TDX and AMD SEV-SNP ⏱️ Chapters 0:00 From Firecracker to Kubernetes 0:32 The problem: one shared kernel 1:12 What is Kata Containers 1:55 Where Kata fits (shim v2) 2:52 Inside the pod VM (kata-agent) 3:44 The hypervisors 4:42 Getting files into the VM (virtio-fs) 5:26 RuntimeClass 6:13 Install with kata-deploy (Helm) 6:55 Demo: runc vs Kata 7:33 The costs and limits 8:17 The security model 8:56 Confidential Containers 9:34 When to use Kata 10:08 Recap 🚀 Quick start (from the Kata docs): export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy" helm install kata-deploy "${CHART}" --version "${VERSION}" Then add to your pod spec: runtimeClassName: kata-qemu 📺 MicroVM series Part 1: MicroVMs Explained Like You're 5 Part 2: Firecracker MicroVMs Hands-On Part 3: Kata Containers (this video) Next: gVisor — a kernel in user space 🔗 References Kata Containers: https://katacontainers.io Kata Containers on GitHub: https://github.com/kata-containers/kata-containers 👍 If this helped you, like the video and subscribe to MrCloudBook for more Docker, Kubernetes, DevOps, and AI security content. #KataContainers #Kubernetes #MicroVM #ContainerSecurity #CloudNative #DevSecOps #Firecracker #DevOps