Open Stack

Hello everybody,
 We discussed in todays regular Kata zoom call a recent change in the guest kernel configuration that increases security of the Kata kernel, but at a small cost to memory footprint size increase. The chance is the enabling of CONFIG_RANDOMIZE_BASE, which came with a kernel config fragment update at https://github.com/kata-containers/packaging/pull/1006
 Details of the security/size discussion can then be found on https://github.com/kata-containers/ci/issues/273.
 The bottom line decision came down to, in general, Security being a more important and key feature for Kata.
 We felt we should try to make this change clear to as much of the Kata community as we could. We will also try to highlight this change in our next release notes.

I'll not post specific byte numbers, as they vary across systems, architectures and specific deployments.
I will note that our specific CI size test, that looks at the size of the Kata components (and *not* the container/payload itself), we saw a 7-8% memory footprint increase. Obviously (or possibly not that obviously), the *overall* change to a real deployment would depend very much on the size and number workloads being deployed, and what percentage the Kata components actually account for in the system as a whole.

Graham

---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.