Kata Containers

提供: ArchWiki
2021年5月19日 (水) 14:18時点におけるKusanaginoturugi (トーク | 投稿記録)による版 (→‎使用方法)
(差分) ← 古い版 | 最新版 (差分) | 新しい版 → (差分)
ナビゲーションに移動 検索に移動


Kata Containers(以前の Clear Containers)は、OCI 互換のアプリケーションコンテナランタイムで、仮想化を利用して、潜在的に信頼できないプロセスを、ホストシステムや他のプロセスから隔離することを目的としています。現在、アップストリームでサポートされているハイパーバイザーは、qemufirecracker-binAURcloud-hypervisorAUR です。


  • kata-agent - supervisor process running on the hypervised guest sandbox, tasked with managing its lifetime
  • kata-runtime - container runtime component responsible for handling commands specified by the OCI runtime specification and tasked with launching shims
  • kata-proxy (before 2.0) - routes I/O streams and signals between on-guest agent and host-side processes associated with running a given sandbox using gRPC
  • kata-shim (before 2.0) - container process monitor and reaper
  • kata-ksm-throttler (optional, before 2.0) -
  • kata-linux-container - patched kernel used to launch VMs serving as container/pod sandboxes
  • kata-containers-image - initramfs and rootfs images used for spawning VM sandboxes


Kata はデフォルトでは /etc/kata-containers/configuration.toml から設定を拾いますが、環境変数 KATA_CONF_FILE で設定のパスを指定することで、これをオーバーライドすることができます。必ず /usr/share/defaults/kata-containers/configuration-qemu.toml からの設定を初期化してください。


Install the runtime kata-runtime-binAUR, kata-proxy-binAUR[リンク切れ: package not found], kata-shim-binAUR[リンク切れ: package not found], kernel kata-linux-container-binAUR and set of initrd and rootfs kata-containers-image-binAUR.


In order to use Kata Containers with Docker, the user needs to add it to supported runtimes in /etc/docker/daemon.json:

   "runtimes": {
     "kata": {
       "path": "/usr/bin/kata-runtime"

To use it as the default runtime for Docker: {"default-runtime": "kata"} .

To use it with the Firecracker hypervisor, due to its limitations, the devicemapper storage driver [1] has to be used: {"storage-driver": "devicemapper"} .

Afterward you can use the runtime key: docker run --runtime kata --rm -ti archlinux/base /bin/bash.


Running a container: podman --runtime /usr/bin/kata-runtime run --rm -ti archlinux/base /bin/bash.

Keep in mind that a Kata VM sandbox conceptually maps to Kubernetes pods or a shared netns, not just individual containers.


Since release 2.0, Kata Containers exclusively uses OCI runtime shim API v2, however Docker has that API version hard-coded to v1, making it unfeasible to use this combination as of this writing.

Install the runtime kata2-runtime-binAUR, kernel kata2-linux-container-binAUR and set of initrd and rootfs kata2-containers-image-binAUR.

Containerd CLI

# ctr image pull docker.io/archlinux/base:latest
# ctr run --rm -t --runtime io.containerd.kata.v2 docker.io/archlinux/base:latest example-container-name date

See also