Learn Kata Containers (a secure microVM-based container runtime for Kubernetes) from the basics to production-grade: prerequisites, history & background, core concepts & architecture, installation & setup, RuntimeClass & workloads, runtime configuration, hypervisor backends, networking, storage, Kata agent & image management, GPU passthrough, confidential containers, debugging & troubleshooting, security model, network security, secure boot & image trust, multi-tenancy & isolation, Kata 4.0 & Rust runtime, Kata in the cloud, AI & agent sandboxes, performance & optimization, ecosystem & community, and a final reflection, with a total of 23 episodes.
Before touching Kata Containers, you need to master the basics of Kubernetes (Pods, nodes, RuntimeClass), containerd, and the concepts of container versus VM isolation. In this episode you'll prepare a node with KVM support, install the Kata tooling, and verify that the entire environment is ready for this series.

This episode traces the origins of Kata Containers from the merger of Intel Clear Containers and Hyper.sh runV in December 2017, its status as an OpenInfra project, and its transition to a Rust runtime. You'll also understand why microVM isolation is needed and who's adopted it in production.

This episode dissects the Kata Containers architecture in full: the flow from containerd shimv2 to the VMM, guest kernel, and the Kata agent. You'll get to know each component, such as containerd-shim-kata-v2, kata-runtime, kata-runtime-rs, and kata-agent, as well as how virtio and VFIO connect the host to the guest.

This episode guides you through installing Kata Containers three ways: a release tarball, kata-deploy via Helm chart, and a build from source. You'll also verify the installation with kata-runtime check and kata-runtime kata-check to make sure KVM and the hypervisor are ready for use.

This episode covers RuntimeClass in full: kata for QEMU, kata-clh for Cloud Hypervisor, kata-fc for Firecracker, and kata-qemu-coco-dev for confidential containers. You'll also run your first pod with spec.runtimeClassName and prove that the application process runs inside the microVM.

This episode dissects /etc/kata-containers/configuration.toml: the hypervisor, kernel, and agent parameters that control the microVM's behavior. You'll learn about memory and CPU limits, the virtio-blk vs virtio-scsi block device driver choice, and kernel_params for tuning the guest kernel.

This episode compares the Kata Containers VMM backends: QEMU as the default with broad compatibility, Cloud Hypervisor which is modern and fast, Firecracker which is minimalist, and Dragonball which is built into the Rust runtime. You'll learn the feature-versus-speed trade-offs and when to choose each backend.

This episode covers Kata Containers networking: how CNI integrates with the microVM, the role of virtio-net inside the guest, the bridge/macvlan/host-device plugins, and per-pod network isolation. You'll also learn about experimental options such as disableNewNetns for special workloads.

This episode covers the data path into the microVM: the rootfs image as virtio-blk, virtio-fs for shared volumes, and device passthrough with VFIO for GPUs and NICs. You'll also learn how emptyDir, PVC, and hostPath work inside the guest.

This episode dissects the Kata agent's role inside the guest: managing containers, exec, mounts, and signals. You'll also understand the two image pull strategies — pulling through the snapshotter on the host then mounting into the guest, versus pulling directly inside the guest — along with the trade-offs of each.
