Search code examples
dockersecuritykubernetessandboxkata-containers

Can kata containers be used as a sandbox to run untrusted code?

Kata containers is trying to make containers secure by providing more isolation.

lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.

If I am building a playground/code fiddle (something like ideone), are they secure enough to compile and run untrusted code?

Is this a good/intended use for this type of containers?

Solution

  • Any type of workload can potentially be used by Kata Containers, just like regular containers. The idea behind them is providing the VM isolation that you don't get with regular containers. You can use Kata Container with Docker and Kubernetes.

    You can achieve a decent level of isolation with regular containers using things like seccomp, SELinux, Capabilities, and/or AppArmor but it can get quite complicated. Kata Containers offers a simpler alternative to that.