--- title: What is Kata Containers and why should I care? description: Kata Containers can significantly improve the security of your workloads. It combines the benefits of using a hypervisor and container orchestration. url: https://canonical.com/blog/what-is-kata-containers?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Tytus Kurek](https://canonical.com/blog/author/tkurek "More about Tytus Kurek") 3 December 2019 # What is Kata Containers and why should I care? [containers](https://canonical.com/blog/tag/containers) [kata-containers](https://canonical.com/blog/tag/kata-containers) [kubernetes](https://canonical.com/blog/tag/kubernetes) [Security](https://canonical.com/blog/tag/security) --- Share the article Kata Containers can significantly improve the security and isolation of your container workloads. It combines the benefits of using a hypervisor, such as enhanced security, and container orchestration capabilities provided by [Kubernetes](https://ubuntu.com/kubernetes). Together with Eric Erns from Intel, we have recently performed a [webinar](https://www.brighttalk.com/webcast/6793/373551/ensuring-security-and-isolation-in-kubernetes-with-kata-containers) in which we presented the benefits of using Kata Containers in a [Charmed Kubernetes](https://jaas.ai/kubernetes) environment. In this blog, we aim to highlight the key outcomes from this webinar. ### Security and isolation issues with containers Over the last few years, container technologies have dominated the market and become the de facto standard for implementing modern IT infrastructure. Because of their lightweight nature and bare-metal-like performance, they are usually preferred over traditional VMs (virtual machines). However, one of the main adoption concerns is around security and isolation. This is because the traditional OCI runtime – runC – relies on Linux kernel features, such as cgroups and namespaces to provide isolation when spawning containers. As a result, containers share the same kernel which is usually considered less secure than using traditional virtualisation. In order to deal with the aforementioned challenges the Kata Containers project has been founded. ### What is Kata Containers? Wait a second, “What is Kata Containers” or “What are Kata Containers”? It may not be intuitive. This is because Kata Containers is a name of the project under the governance of the [OpenStack Foundation](https://www.openstack.org/foundation/). It is also a name of the OCI (Open Container Initiative) runtime which the project uses. So now as we know what is Kata Containers, let’s focus on its architecture and the benefits it brings. Contrary to the runC runtime, the Kata Containers runtime uses a hypervisor to provide isolation when spawning containers. It creates lightweight VMs and puts containers inside. The figure below demonstrates this concept. As a result, each container runs on its own kernel eliminating security limitations of the traditional runC runtime. Source: [https://medium.com/kata-containers/why-kata-containers-doesnt-replace-kubernetes-75e484679727](https://medium.com/kata-containers/why-kata-containers-doesnt-replace-kubernetes-75e484679727) One of the biggest advantages of Kata Containers over traditional VMs is that it seamlessly plugs to existing container orchestration platforms like Kubernetes. While you are launching VMs, native Kubernetes features, such as auto-scaling or rolling updates are still available. This allows to combine the benefits of using virtualisation technology and container orchestration capabilities. ### Explore Kata Containers One of the fastest ways to get started with Kata Containers is to deploy it in the [Charmed Kubernetes](https://ubuntu.com/kubernetes) environment. Once you have Charmed Kubernetes up and running, there are just four commands to deploy this extension: ``` $ juju deploy cs:~containers/kata $ juju relate kata kubernetes-master $ juju relate kata kubernetes-worker $ juju relate kata:untrusted containerd:untrusted ``` The first one deploys the Kata Containers runtime, while the other ones configure Kubernetes services to use it. Such an approach is scalable even in clusters consisting of hundreds of nodes. Once deployed, you can use the new runtime in a very intuitive way. First, create a RuntimeClass object: ``` $ echo > kata.yaml apiVersion: node.k8s.io/v1beta1 kind: RuntimeClass metadata: name: kata handler: kata EOF $ kubectl create -f kata.yaml runtimeclass.node.k8s.io/kata created ``` Then you can refer it when creating a pod or deployment. Simply add a runtimeClassName parameter to the spec section of your YAML file and refer to the class you created. for example: ``` $ cat nginx-kata.yaml apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: run: nginx-kata name: nginx-kata spec: runtimeClassName: kata containers: - image: nginx name: nginx-kata resources: {} dnsPolicy: ClusterFirst restartPolicy: Never status: {} ``` Now when creating the nginx-kata pod, it will be created using the Kata Containers runtime. For more more information, read the tutorial: [Ensuring security and isolation in Charmed Kubernetes with Kata Containers](https://tutorials.ubuntu.com/tutorial/charmed-kubernetes-kata-containers#0). ### Conclusions If you are looking for a solution to secure your container workloads while still running them on top of Kubernetes then Kata Containers is the answer. Regardless of the size of your cluster, you can enable the extension in Charmed Kubernetes by running just four commands. To learn more about Canonical’s solutions for Kubernetes visit our [website](https://ubuntu.com/kubernetes). For more information about Kata Containers, refer to the official project [website](https://katacontainers.io/). ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026