FYI, we just released a blog post about Kata Containers 1.3 and 1.4 releases, see https://katacontainers.io/posts/kata-containers-13-14-release-updates/ . The blog contents are also listed here for your reference. ------------------------------------------- Hello Kata Kats, I'm proud to see the rapid advancement of the Kata Containers project as of late. Since September, we’ve done several releases which introduce features to help Cloud Service Providers (CSPs) and others who plan to deploy Kata into production. We are fortunate to have input to the Kata community project from some of the world’s largest cloud service providers, operating system vendors and telecom equipment makers such that we can better serve their internal infrastructure needs as well as enterprise customers. The Kata Containers 1.4.0 release has several nice new features and many bug-fixes. All users are recommended to upgrade. We also released a new stable release (v 1.3.1) for which only kernel changes were relevant. The 1.4.0 release highlights following features: - Host cgroups support: The virtual machine is now constrained in a host side cpu cgroup, enabling the requested cpu quota and periods to be better honored. This protects against a single container using up host resources which could lead to things like denial of service. - NEMU `virt` machine type support: This new machine type is specially optimized for cloud environments and a great fit for Kata Containers use cases. NEMU is a lighter weight version of QEMU intended to reduce the attack footprint of the VM, thus improving the security model even more. To learn more about NEMU, see https://github.com/intel/nemu. - New NetInterworkingModel `none`: It works with tap endpoint types so that enlightened CNI plugins can add tap devices to a sandbox directly, skipping extra steps and complexity introduced with the host’s network namespaces. - New NetInterworkingModel `tcfilter`: Yet another method for Kata Containers to bridge the host netns veth and guest tap device, with TC filter rules. With it, Kata Containers have more compatibility with different network endpoint types and CNI plugins. - Enable macvlan and ipvlan network support: These two networking models provide lightweight and fast access to underlay or host interfaces without NATing. - Guest rootfs image can now have a `guest_hook_path` that specifies the path to OCI hook binaries within the guest to provide support to run OCI hooks within the guest. This feature helps with vendor-specific device passthrough to the Kata VM, for example. For full details of v1.4 release features, please see https://github.com/kata-containers/runtime/releases/tag/1.4.0 For the new stable v1.3.1 release, only kernel changes were relevant for that branch. https://github.com/kata-containers/runtime/releases/tag/1.3.1 In September we released the 1.3.0 release and 1.2.2 stable releases with features like Network and Memory hotplug in order to better support CSP customers’ running production environments. We also continued our pursuit to be cross-architecture by adding more support for ARM64 as well as Intel(R) Graphics Virtualization Technology. To re-cap v1.3.0 feature highlights in case you missed the announcement: - Network hotplug: Sandbox network can now be dynamically changed by the "kata-runtime network" subcommand. This allows customized CNI plugins to create more Kata-native network endpoints within a running container and better support for live dynamic network reconfiguration. - Network monitoring: a new kata component (kata-netmon) is added to monitor container netns on the host. Now CNI hooks to dynamically change the network setup of a running container and "docker network connect" work with Kata Containers. - Network multiqueue support: Network cards are added to to the guest with multiqueue support allowing Kata Containers to gain better network performance by running multiple threads in parallel. - Memory hotplug: "kata-runtime update" subcommand can now add extra memory to a running container for long-lived dynamically reconfigured pods. - Better container memory constraint support: containers in the same Kata sandbox (VM) can be constrained by memcg inside the guest. - GPU support: both Intel(R) GVT-g and GVT-d GPU devices can now be used by Kata Containers. - Architecture/ARM64: add GICv4 or higher support. For full details, please see https://github.com/kata-containers/runtime/releases/tag/1.3.0 The 1.2.2 stable release had several important fixes. Users who want to stick with stable-1.2 branch were recommended to update. For full details, please see https://github.com/kata-containers/runtime/releases/tag/1.2.2 Thanks to all contributors who are helping to advance Kata Containers in order to better serve our growing number of users! Cheers, Tao Peng Tao Software Engineer Hyper.SH [1[ Intel® Graphics Virtualization Technology –d (Intel® GVT –d): vDGA: virtual dedicated graphics acceleration (one VM to one physical GPU) [2] Intel® Graphics Virtualization Technology –g (Intel® GVT -g): vGPU: virtual graphics processing unit (multiple VMs to one physical GPU) [3] ARM® Generic Interrupt Controller Architecture Specification GIC architecture version 4.0