Hi All, On Thu, Feb 13, 2020 at 10:25:00AM +0000, Whaley, Graham wrote:
Q. What is the most important thing (be it an integration, a particular feature, adopting a policy, etc) Kata Containers needs to achieve in the next year and how should we get there?
Since early on, Kata Containers threat model has been centered around protecting the host from malicious container workloads. During the next year, I'd like to see that threat model being extended to also protecting container workloads from the host infrastructure itself. I believe the Kata Containers architecture can be expanded to address that rising use case where containers can be securely deployed over untrusted hosts by: * Handling the CRI image operations from the guest itself. This is a fairly intrusive change that will impact many layers of the stack (Runtimes, kata agent, kata runtime) and our performance overhead as well. * Enabling and using hardware based total memory encryption technologies in order to prevent the host infrastructure from reaching the container assigned memory. I would also like to work on making things easier for newcomers to contribute to the project. And for that I'd like to use Kata Containers 2.0 as an opportunity for our community to prune the list of supported features and configuration knobs, and to also reduce our code complexity. Both aspects are related and will not only benefit potential newcomers but also our existing contributors and users. Cheers, Samuel.