Open Stack

Hi All,

On Thu, Feb 13, 2020 at 10:25:00AM +0000, Whaley, Graham wrote:
> Q. What is the most important thing (be it an integration, a particular feature, adopting a policy, etc) Kata Containers needs to achieve in the next year and how should we get there?
>

Since early on, Kata Containers threat model has been centered around
protecting the host from malicious container workloads. During the next
year, I'd like to see that threat model being extended to also protecting
container workloads from the host infrastructure itself. I believe the
Kata Containers architecture can be expanded to address that rising use
case where containers can be securely deployed over untrusted hosts by:

* Handling the CRI image operations from the guest itself. This is a
  fairly intrusive change that will impact many layers of the stack
  (Runtimes, kata agent, kata runtime) and our performance overhead as
  well.
* Enabling and using hardware based total memory encryption technologies
  in order to prevent the host infrastructure from reaching the
  container assigned memory.

I would also like to work on making things easier for newcomers to
contribute to the project. And for that I'd like to use Kata Containers
2.0 as an opportunity for our community to prune the list of supported
features and configuration knobs, and to also reduce our code complexity.
Both aspects are related and will not only benefit potential newcomers
but also our existing contributors and users.

Cheers,
Samuel.