This guide walks through configuring MTU, building root‑filesystem images and custom kernels, deploying Kata Containers on Kubernetes, and applying virtioFS rate‑limiting to achieve VM‑level isolation with near‑container performance for high‑security workloads.
Longxi 8.4 now supports confidential containers built on HaiGuang's CSV technology, offering encrypted lifecycle, isolated compute resources, measurable startup, and remote attestation that together create a fully secure container environment integrated with Kata and Inclavare Containers.
This article explains the challenges of CRI integration with multiple container runtimes, introduces Containerd ShimV2 as a standardized interface, and provides step‑by‑step instructions for configuring Kata Containers as a Kubernetes runtime using RuntimeClass or untrusted_workload_runtime methods.
This article explains the concept of secure containers, their definition based on the OCI specification, and how projects like Kata Containers and gVisor implement isolation layers to provide VM‑level security with container‑level performance in cloud‑native environments.
Meituan's security team explains cloud‑native architecture, outlines container‑escape threats from kernel bugs, vulnerable runtimes and misconfigurations, and recommends mitigation through hardened kernels, secure‑container runtimes like gVisor or Kata, rigorous patch management, and collaborative feature development to strengthen runtime protection.
This article explains the concept of secure containers, traces their naming history, defines their role in cloud‑native environments, and details the architectures of Kata Containers and gVisor as modern solutions that add isolation layers to improve container security and performance.
This article reviews the development of secure container technologies, including the history of container isolation, the design of MicroVM‑based solutions like Kata Containers, Alibaba Cloud's security sandbox architecture, performance benchmarks, and future challenges for secure cloud‑native runtimes.
