- TechOps Examples
- Posts
- Kata vs Traditional Containers
Kata vs Traditional Containers
Govardhana M K
November 25, 2025
In partnership with
TechOps Examples
Hey — It's Govardhana MK 👋
Welcome to another technical edition.
Every Tuesday – You’ll receive a free edition with a byte-size use case, remote job opportunities, top news, tools, and articles.
Every Thursday and Saturday – You’ll receive a special edition with a deep dive use case, remote job opportunities and articles.
👋 👋 A big thank you to today's sponsor THE HUSTLE DAILY
200+ AI Side Hustles to Start Right Now
While you were debating if AI would take your job, other people started using it to print money. Seriously.
That's not hyperbole. People are literally using ChatGPT to write Etsy descriptions that convert 3x better. Claude to build entire SaaS products without coding. Midjourney to create designs clients pay thousands for.
The Hustle found 200+ ways regular humans are turning AI into income. Subscribe to The Hustle for the full guide and unlock daily business intel that's actually interesting.
IN TODAY'S EDITION
🧠 Use Case
Kata vs Traditional Containers
👀 Remote Jobs
Protege is hiring a DevOps Engineer
Remote Location: Worldwide
Dandy is hiring a Engineering Manager, Machine Learning Operations
Remote Location: Worldwide
📚️ Resources
If you’re not a subscriber, here’s what you missed last week.
To receive all the full articles and support TechOps Examples, consider subscribing:
🧠 USE CASE
Kata vs Traditional Containers
Kata Containers is now one of the leading methods for running containers inside isolated virtual machines.
What are Kata Containers?
Kata Containers perform like containers, but provide the workload isolation and security advantages of VMs. It combines the benefits of containers and VMs.
The project is managed by the OpenStack Foundation.
With Kata, you can implement VM isolation at the container level and container isolation using hardware virtualization.
However, in Kubernetes, VM isolation applies at the pod level rather than individual containers.
Difference between Kata and Traditional containers:
As you can see in the above image, Kata Containers run each container inside its own virtual machine (VM) with a separate Linux kernel, providing stronger isolation.
In contrast, traditional containers share a single Linux kernel and use namespaces and cgroups for isolation. This highlights the key difference in how they handle security and isolation.
The architecture consists of six key components:
Agent: Manages container execution and communication inside the virtual machine.
Runtime: Executes container lifecycle commands, following OCI specifications.
Proxy: Facilitates communication between the runtime and the virtual machine through gRPC.
Shim: Provides compatibility for handling I/O and process management specific to each application.
Kernel: The virtual machine’s operating system kernel, ensuring isolated environments for containers.
Hypervisor (QEMU): Provides hardware virtualization, isolating containers in lightweight virtual machines.
Why Kata Containers are better Secured ?
Conventional containers pose security risks because they share the same OS kernel, network, and memory. A single compromised container can expose all others on the same system.
Kata Containers improve security by running each container in its own virtual machine with a dedicated kernel, isolating processes, network, and memory. They also use hardware-based isolation with virtualization extensions, adding an extra layer of protection.
Points to Consider:
Only available on Linux distributions.
CentOS
Debian
Fedora
Ubuntu
OpenSUSE
Red Hat Enterprise Linux
Still in early development, but widely adopted with promising technical foundations.
Supports Kubernetes, Docker, OCI, CRI, CNI, QEMU, KVM, and OpenStack.
Installation and more details here
Kata containers are best for situations where containers need to run on different kernels, like in CI/CD, edge computing, virtualized networks, and containers as a service (CaaS).
A promising prospect to check out !
Closing Thoughts:
"Security focused organizations are steadily adopting sandboxed container runtimes to reduce blast radius and kernel level attacks."
Do not ignore Kata just because your workloads run fine today.
Security incidents never warn you before they happen.
Do not stay limited to one container runtime expertise.
Become strong in one and experiment with alternatives like Kata, gVisor, Firecracker and others.
🔴 Get my DevOps & Kubernetes ebooks! (free for Premium Club and Personal Tier newsletter subscribers)