Home

Awesome

<!-- TOC start --> <!-- TOC end -->

Introduction to sandboxed containers

OpenShift sandboxed containers, based on the Kata Containers open source project, provides an Open Container Initiative (OCI) compliant container runtime using lightweight virtual machines, running your workloads in their own isolated kernel and therefore contributing an additional layer of isolation back to OpenShift’s Defense-in-Depth strategy.

Features & benefits of sandboxed containers

Please refer to this blog for a detailed overview of sandboxed containers use cases and other related details.

OpenShift sandboxed containers Operator

The operator manages the lifecycle (install/configure/update) of sandboxed containers runtime (Kata containers) on OpenShift clusters.

Operator Architecture

The following diagram shows how the operator components are connected to the OpenShift overall architecture:

High Level Overview

Here is a brief summary of the components:

KataConfig Custom Resource Definition

The operator owns and control the KataConfig Custom Resource Definition (CRD). Please refer to the code to find details of the KataConfig CRD.

Getting Started

Please refer to the OpenShift release specific documentation for getting started with sandboxed containers.

Further note that starting with OpenShift 4.9, the branch naming is tied to the operator version and not the OpenShift version. For example release-1.1 corresponds to the Operator release verson 1.1.x.

Operator Development

Please take a look at the following doc. Contributions are most welcome!!

Demos

You can find various demos in the following youtube channel.

Further Reading