Rust Rewrite Readies Kata Containers for Agent Sandboxing
The OpenInfra Foundation has released version 4 of Kata Containers, which arrives with a new Rust-based default runtime that brings new memory safety and performance gains.
With the Rust rewrite, the Foundation has positioned the open source project as a key runtime for Agent Sandbox, a Kubernetes SIG Apps umbrella project for managing secure sandboxes for running AI agents.
Kata was designed to spin up lightweight but secure virtual machines with the speed of regular Linux containers. It is commonly used to provide secure runtimes for multi-tenant Kubernetes deployments, software build pipelines and, most recently, AI infrastructure.
A Stronger Sandbox
Kata 4.0 “directly addresses the stringent security and efficiency requirements of modern AI sandboxing,” noted Fupan Li, Kata Containers architecture committee member, in a statement.
Li is also head of container technology for the Ant Group, a major fintech and technology affiliate of Alibaba. Ant has been using Kata first for batch workloads and then for core online services, where it has facilitated real-time security auditing and mitigation of malicious activity, Li said.
Now, the group is using Kata as a foundation for its AI agents, thanks to its combination of isolation and fast start times.
Because Kata Containers runs each workload inside its own lightweight virtual machine, the technology can be very useful for running AI agents. Agents work best within tight boundaries. If there is an opening that allows an agent to move laterally across a cluster, it will do so.
As NVIDIA engineer Zvonko Kaiser noted in an OpenInfra livestream panel, agents are quite different from the traditional microservices workload, in that microservices have strict execution paths, whereas agents can be … nondeterministic, a fancy word for unpredictable.
Hence, Kata’s virtual machine-level isolation could provide a strict isolation that would contain agents to known environments.
Rust Runtime
The new default Rust-based runtime, runtime-rs, replaces the original runtime written in Go. The swap brings better memory safety, a tighter memory footprint and faster start-up, the foundation claimed.
The rewrite brings a number of advantages. The runtime manages storage better, particularly block storage in Kubernetes environs. Multi-queue networking is now supported for all hypervisors. It also offers improved memory management.
Sandbox resource accounting now includes runtime overhead, which is important for Kubernetes pod scheduling.
For the project, the Ant Group led the development of a new Rust-based in-process Virtual Machine Monitor, called Dragonball, a lightweight hypervisor to manage the virtual machines. Dragonball, the new default hypervisor of Kata, serves as a lighter-weight alternative to the other hypervisors Kata supports, namely QEMU and Cloud Hypervisor.
In addition to the new Rust engine, version 4.0 also debuts a set of formalized release acceptance criteria as well as expanded hardware and hypervisor support. The supply chain has also been tightened with stricter CI checks, according to the foundation.
Kata Containers 4.0 release notes state that while the new version is compatible with existing Kata workloads, users might experience “some minor differences in configuration and behavior” when they switch over.
The now-legacy Go runtime will continue to receive bug and security fixes at least until the release of Kata Containers 5.0. No new features will be added to this edition.
