Kata Containers
An OCI runtime that runs each Kubernetes pod in a lightweight VM with its own kernel, on QEMU, Cloud Hypervisor, Firecracker, Dragonball or StratoVirt. The standard way to put a VM boundary around Kubernetes pods; choose it when your sandboxes are already pods.
Overview
Kata Containers is an open-source container runtime stewarded by the OpenInfra Foundation and licensed Apache-2.0. It builds "lightweight virtual machines that seamlessly plug into the containers ecosystem": each workload "runs in a dedicated kernel, providing isolation of network, I/O and memory", with hardware virtualisation as "a second layer of defense". The main runtime is a containerd shim v2 implementation that speaks OCI and the Kubernetes CRI, so a cluster selects it with a RuntimeClass; packaging includes the kata-deploy Helm chart. Kata is a hypervisor orchestration layer rather than a VMM: its hypervisors document lists QEMU (all architectures, best for NVIDIA GPUs and confidential computing), Cloud Hypervisor, Firecracker, Ant Group's in-process Dragonball and StratoVirt (the last four on x86_64 and aarch64), and supported architectures include ppc64le and s390x.
On this site, Northflank is the platform that documents building on Kata: its security page says "Kata Containers are used as the default runtime class for workloads in the cluster" and that this "applies KVM and micro-VMs through Cloud Hypervisor to secure the workloads from the host kernel", with gVisor as the alternative where nested virtualisation is unavailable. Kata itself names Baidu as a production user for function computing and container instances. Kata Containers 4.3.1 was released on 21 October 2026. Snapshots, pause/resume and session limits are properties of the chosen hypervisor and orchestrator, not of Kata, and are not documented at the project level.
Notable
- Stewarded by the OpenInfra Foundation; Apache-2.0
- Kata Containers 4.3.1 released 21 October 2026 (4.3.0 on 20 October, 4.2.0 on 15 September)
- Northflank documents Kata with Cloud Hypervisor as its default runtime class; Baidu runs Kata in production for Function Computing, Cloud Container Instances and Edge Computing
Kata Containers specifications
| Attribute | Details |
|---|---|
| Isolation | Lightweight VM per pod with a dedicated guest kernel, run by a pluggable hypervisor (QEMU, Cloud Hypervisor, Firecracker, Dragonball or StratoVirt) behind a containerd shim v2 |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | Not documented |
| GPU | Yes - the hypervisors document says QEMU "is the best supported hypervisor for NVIDIA-based GPUs and for confidential computing use-cases" |
| Networking | Not documented |
| Pricing | Free and open source |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Kata Containers’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You run Kubernetes and want VM-grade isolation per pod selected with a RuntimeClass
- You need a choice of hypervisor, including QEMU for GPU and confidential-computing workloads
- You want an actively maintained, foundation-governed project with multi-architecture support
Trade-offs
- Needs KVM on the node, so most cloud VM node pools require bare-metal or nested-virtualisation instances
- An orchestration layer, not a sandbox API: snapshots, pause/resume and lifecycle are left to the hypervisor and your platform
- More moving parts (guest kernel, agent, shim, hypervisor) than a user-space kernel such as gVisor
Good fit for: Kubernetes clusters that need VM isolation per pod without leaving the container toolchain.
How Kata Containers compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Kata Containers | VM per pod | Yes | Yes / No | Not documented | Not documented | Not documented / Not documented | Yes | CLI |
| Firecracker | KVM microVM | Yes | Yes / No | <125 ms (spec) | Not documented | Yes / Yes | No | REST API, CLI |
| gVisor | User-space kernel | Yes | Yes / No | ms (claim) | Not documented | Yes / Not documented | Yes | CLI |
| Edera | Xen-based zone VM | No | Yes / No | Not documented | Not documented | Not documented / Not documented | Yes | CLI |
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| Northflank Sandboxes | Cloud Hypervisor microVM | No | No / Yes | <1 s | Unlimited | Not documented / Yes | Yes | JavaScript/TypeScript, Python |
Frequently asked questions
What is Kata Containers?
How does Kata Containers isolate code?
Is Kata Containers open source?
How much does Kata Containers cost?
What are the alternatives to Kata Containers?
Sources
Cite this page
Agent Sandboxes. (2026). Kata Containers. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/kata-containers/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.