CINXE.COM

<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/><meta name="generator" content="Gatsby 5.12.9"/><meta charSet="utf-8"/><meta name="image" content="/img/android-chrome-192x192.png"/><meta name="theme-color" content="#f15b3e"/><meta property="og:url" content="https://katacontainers.io/"/><meta property="og:title" content="Kata Containers"/><meta property="og:description" content="Kata Containers is an open source container runtime, building lightweight virtual machines that seamlessly plug into the containers ecosystem."/><meta property="og:image" content="https://katacontainers.io//img/android-chrome-192x192.png"/><meta name="twitter:card" content="summary"/><meta name="twitter:creator" content="@katacontainers"/><meta name="twitter:site" content="@katacontainers"/><meta name="twitter:title" content="Kata Containers"/><meta name="twitter:description" content="Kata Containers is an open source container runtime, building lightweight virtual machines that seamlessly plug into the containers ecosystem."/><meta name="twitter:image" content="https://katacontainers.io//img/android-chrome-192x192.png"/><meta name="description" content="undefined"/><meta property="og:type" content="article"/><meta property="article:published_time" content="13/03/2023"/><meta name="theme-color" content="#f15b3e"/><title>Inject Workloads with Kata Containers in Istio | Blog</title><link rel="apple-touch-icon" sizes="180x180" href="/img/apple-touch-icon.png"/><link rel="icon" type="image/png" href="/img/favicon-32x32.png" sizes="32x32"/><link rel="icon" type="image/png" href="/img/favicon-16x16.png" sizes="16x16"/><noscript><style>.gatsby-image-wrapper noscript [data-main-image]{opacity:1!important}.gatsby-image-wrapper [data-placeholder-image]{opacity:0!important}</style></noscript><script type="module">const e="undefined"!=typeof HTMLImageElement&&"loading"in HTMLImageElement.prototype;e&&document.body.addEventListener("load",(function(e){const t=e.target;if(void 0===t.dataset.mainImage)return;if(void 0===t.dataset.gatsbyImageSsr)return;let a=null,n=t;for(;null===a&&n;)void 0!==n.parentNode.dataset.gatsbyImageWrapper&&(a=n.parentNode),n=n.parentNode;const o=a.querySelector("[data-placeholder-image]"),r=new Image;r.src=t.currentSrc,r.decode().catch((()=>{})).then((()=>{t.style.opacity=1,o&&(o.style.opacity=0,o.style.transition="opacity 500ms linear")}))}),!0);</script><link rel="preconnect" href="https://www.google-analytics.com"/><link rel="dns-prefetch" href="https://www.google-analytics.com"/><script> function gaOptout(){document.cookie=disableStr+'=true; expires=Thu, 31 Dec 2099 23:59:59 UTC;path=/',window[disableStr]=!0}var gaProperty='UA-110599884-1',disableStr='ga-disable-'+gaProperty;document.cookie.indexOf(disableStr+'=true')>-1&&(window[disableStr]=!0); if(!(parseInt(navigator.doNotTrack) === 1 || parseInt(window.doNotTrack) === 1 || parseInt(navigator.msDoNotTrack) === 1 || navigator.doNotTrack === "yes")) { (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); } if (typeof ga === "function") { ga('create', 'UA-110599884-1', 'auto', {}); ga('set', 'anonymizeIp', true); }</script><link rel="preconnect" href="https://www.googletagmanager.com"/><link rel="dns-prefetch" href="https://www.googletagmanager.com"/><link rel="icon" href="/favicon-32x32.png?v=6af75a9ad2c06283f1d8394d536a5a46" type="image/png"/><link rel="manifest" href="/manifest.webmanifest" crossorigin="anonymous"/><link rel="apple-touch-icon" sizes="48x48" href="/icons/icon-48x48.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="72x72" href="/icons/icon-72x72.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="96x96" href="/icons/icon-96x96.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="144x144" href="/icons/icon-144x144.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="192x192" href="/icons/icon-192x192.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="256x256" href="/icons/icon-256x256.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="384x384" href="/icons/icon-384x384.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><link rel="apple-touch-icon" sizes="512x512" href="/icons/icon-512x512.png?v=6af75a9ad2c06283f1d8394d536a5a46"/><style data-href="/styles.e10935af12cb1ddc72dc.css" data-identity="gatsby-global-css">@import url(https://fonts.googleapis.com/css2?family=Jura:wght@700&family=Roboto:wght@400;700&display=swap);a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{border:0;font-size:100%;margin:0;padding:0;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}.project___1BAp9{color:#fff;display:flex;text-decoration:none}.project___1BAp9:visited{color:#fff}.project___1BAp9:focus,.project___1BAp9:hover{color:#fff;text-decoration:none}.project___1BAp9 .logoContainer___Meavc{background:#fff;border-radius:5px;display:flex;height:50px;justify-content:center;min-height:50px;min-width:50px;width:50px}.project___1BAp9 .logoContainer___Meavc .logo___3_TWX{align-self:center;height:30px;width:auto}.project___1BAp9 .text___3QXl6{display:flex;flex-direction:column;margin-left:15px}.project___1BAp9 .text___3QXl6 .title___290yb{font-size:14px;font-weight:700;line-height:16px;margin-bottom:8px}.project___1BAp9 .text___3QXl6 .description___2DI-M{color:#a7a9ac;font-size:11px;font-weight:400;line-height:13px}.popup___3n06X{background-color:#161616;border:1px solid #a7a9ac;color:#fff;position:absolute;right:-35px;top:51px;width:520px;z-index:10000}.popup___3n06X .title___1FMFz{font-family:Jura,sans-serif;font-size:14px;font-weight:700;line-height:17px;padding:30px 25px 0}.popup___3n06X .projects___1XXwv{font-family:Roboto,sans-serif;padding:30px 25px 0}.popup___3n06X .projects___1XXwv .projectsWrapper___eGfub{display:grid;gap:30px 15px;grid-template-columns:1fr 1fr}.popup___3n06X .footer___3zqii{align-content:center;display:flex;font-family:Roboto,sans-serif;font-size:12px;justify-content:space-between;line-height:14px;padding:30px 25px}.popup___3n06X .footer___3zqii .link___36fsK{align-self:center}.popup___3n06X .footer___3zqii a{color:#f7b749;font-weight:700}.popup___3n06X .footer___3zqii .brand___1MNAA{align-items:center;display:flex;font-family:Jura,sans-serif;font-size:18px;font-weight:700}.popup___3n06X .footer___3zqii .brand___1MNAA img{cursor:auto;height:25px;margin-right:10px;width:25px}.popup___3n06X hr{border-top:1px solid #a7a9ac;height:1px;margin-top:30px}.popup___3n06X .outerTriangle___2K947{border:20px solid hsla(0,0%,9%,0);border-bottom-color:#a7a9ac;content:" ";height:0;pointer-events:none;position:absolute;right:25px;top:-40px;width:0}.popup___3n06X .outerTriangle___2K947 .innerTriangle___j84_d{border:19px solid hsla(0,0%,9%,0);border-bottom-color:#161616;content:" ";height:0;pointer-events:none;position:absolute;right:-19px;top:-17px;width:0}@media (max-width:768px){.popup___3n06X{right:0;width:90vw}.popup___3n06X .outerTriangle___2K947{right:10px}}@media (max-width:550px){.popup___3n06X .projects___1XXwv .projectsWrapper___eGfub{display:grid;gap:30px 15px;grid-template-columns:1fr}.popup___3n06X .footer___3zqii{align-items:center;flex-direction:column;gap:25px}}.navbar___3SVld{background-color:#161616;color:#fff}.navbar___3SVld .container___E0DqP{align-content:center;display:flex;height:40px;justify-content:center}.navbar___3SVld .container___E0DqP .brand___ZOIKE{align-items:center;align-self:center;display:flex;font-family:Jura,sans-serif;font-size:14px;font-weight:700;line-height:16.56px}.navbar___3SVld .container___E0DqP .brand___ZOIKE .logo___1fq4T{margin-right:15px}.navbar___3SVld .container___E0DqP .brand___ZOIKE .logo___1fq4T img{height:20px;width:20px}.navbar___3SVld .container___E0DqP .menu___2CAGc{align-self:center;margin-left:auto;position:relative}.navbar___3SVld .container___E0DqP .menu___2CAGc .menuIcon___2xOq1{cursor:pointer;height:20px;width:20px}@media screen and (max-width:768px){.navbar___3SVld .container___E0DqP .menu___2CAGc .menuIcon___2xOq1{margin-right:20px}}.navbar___3SVld .container___E0DqP .background___1IeG_{height:100%;left:0;position:fixed;top:40px;width:100%;z-index:9000}.navbar>.container{min-height:0!important}/*! bulma.io v0.7.1 | MIT License | github.com/jgthms/bulma */@keyframes spinAround{0%{transform:rotate(0deg)}to{transform:rotate(359deg)}}.button{-webkit-touch-callout:none;-webkit-user-select:none;user-select:none}.box:not(:last-child),.level:not(:last-child),.table:not(:last-child),.title:not(:last-child){margin-bottom:1.5rem}.button{align-items:center;-moz-appearance:none;-webkit-appearance:none;border:1px solid transparent;border-radius:4px;box-shadow:none;display:inline-flex;font-size:1rem;height:2.25em;justify-content:flex-start;line-height:1.5;padding:calc(.375em - 1px) calc(.625em - 1px);position:relative;vertical-align:top}.button:active,.button:focus,.is-active.button{outline:none}/*! minireset.css v0.0.3 | MIT License | github.com/jgthms/minireset.css */blockquote,body,figure,h1,h2,h3,h4,h5,h6,hr,html,iframe,li,ol,p,pre,ul{margin:0;padding:0}h1,h2,h3,h4,h5,h6{font-size:100%;font-weight:400}button{margin:0}html{box-sizing:border-box}*,:after,:before{box-sizing:inherit}img,video{height:auto;max-width:100%}iframe{border:0}table{border-collapse:collapse;border-spacing:0}td{padding:0;text-align:left}html{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;text-size-adjust:100%;background-color:#fff;font-size:14px;min-width:300px;overflow-x:hidden;overflow-y:scroll;text-rendering:optimizeLegibility}article,aside,figure,footer,header,section{display:block}body,button{font-family:Roboto,sans-serif}code,pre{-moz-osx-font-smoothing:auto;-webkit-font-smoothing:auto;font-family:monospace}body{color:#4a4a4a;font-size:1rem;font-weight:400;line-height:1.2}a{color:#3273dc;cursor:pointer;text-decoration:none}a:hover{color:#363636}code{color:#ff3860;font-size:.875em;font-weight:400;padding:.25em .5em}code,hr{background-color:#f5f5f5}span{font-style:inherit;font-weight:inherit}pre{-webkit-overflow-scrolling:touch;background-color:#f5f5f5;color:#4a4a4a;font-size:.875em;overflow-x:auto;padding:1.25rem 1.5rem;white-space:pre}pre code{background-color:transparent;color:currentColor;font-size:1em;padding:0}table td{text-align:left;vertical-align:top}.has-text-centered{text-align:center!important}.box{background-color:#fff;border-radius:6px;box-shadow:0 2px 3px rgba(34,34,34,.1),0 0 0 1px rgba(34,34,34,.1);color:#4a4a4a;display:block;padding:1.25rem}a.box:focus,a.box:hover{box-shadow:0 2px 3px rgba(34,34,34,.1),0 0 0 1px #3273dc}a.box:active{box-shadow:inset 0 1px 2px rgba(34,34,34,.2),0 0 0 1px #3273dc}.button{background-color:#fff;border-color:#dbdbdb;border-width:1px;color:#363636;cursor:pointer;justify-content:center;padding:calc(.375em - 1px) .75em;text-align:center;white-space:nowrap}.button .icon{height:1.5em;width:1.5em}.button .icon:first-child:not(:last-child){margin-left:calc(-.375em - 1px);margin-right:.1875em}.button .icon:last-child:not(:first-child){margin-left:.1875em;margin-right:calc(-.375em - 1px)}.button .icon:first-child:last-child{margin-left:calc(-.375em - 1px);margin-right:calc(-.375em - 1px)}.button:hover{border-color:#b5b5b5;color:#363636}.button:focus{border-color:#3273dc;color:#363636}.button:focus:not(:active){box-shadow:0 0 0 .125em rgba(50,115,220,.25)}.button.is-active,.button:active{border-color:#4a4a4a;color:#363636}.button.is-primary{background-color:#f15b3e;border-color:transparent}.button.is-primary:hover{background-color:#f05132}.button.is-primary:focus,.button.is-primary:hover{border-color:transparent;color:#fff}.button.is-primary:focus:not(:active){box-shadow:0 0 0 .125em rgba(241,91,62,.25)}.button.is-primary.is-active,.button.is-primary:active{background-color:#ef4726;border-color:transparent;color:#fff}.button.is-dark{background-color:#0c0016;border-color:transparent;color:#fff}.button.is-dark:hover{background-color:#050009}.button.is-dark:focus,.button.is-dark:hover{border-color:transparent;color:#fff}.button.is-dark:focus:not(:active){box-shadow:0 0 0 .125em rgba(12,0,22,.25)}.button.is-dark.is-active,.button.is-dark:active{background-color:#000;border-color:transparent;color:#fff}.button.is-dark-gray{background-color:#333;border-color:transparent;color:#fff}.button.is-dark-gray:hover{background-color:#2d2d2d}.button.is-dark-gray:focus,.button.is-dark-gray:hover{border-color:transparent;color:#fff}.button.is-dark-gray:focus:not(:active){box-shadow:0 0 0 .125em rgba(51,51,51,.25)}.button.is-dark-gray.is-active,.button.is-dark-gray:active{background-color:#262626;border-color:transparent;color:#fff}.button.is-rounded{border-radius:290486px;padding-left:1em;padding-right:1em}.buttons{align-items:center;display:flex;flex-wrap:wrap;justify-content:flex-start}.buttons .button{margin-bottom:.5rem}.buttons .button:not(:last-child){margin-right:.5rem}.buttons:last-child{margin-bottom:-.5rem}.buttons:not(:last-child){margin-bottom:1rem}.buttons.is-centered{justify-content:center}.container{margin:0 auto;position:relative}@media screen and (min-width:1088px){.container{max-width:960px;width:960px}}@media screen and (min-width:1280px){.container{max-width:1152px;width:1152px}}@media screen and (min-width:1472px){.container{max-width:1344px;width:1344px}}.label{color:#363636;display:block;font-size:1rem;font-weight:700}.label:not(:last-child){margin-bottom:.5em}.field:not(:last-child){margin-bottom:.75rem}.icon{align-items:center;display:inline-flex;height:1.5rem;justify-content:center;width:1.5rem}.image{display:block;position:relative}.image img{display:block;height:auto;width:100%}.image img.is-rounded{border-radius:290486px}.image.is-64x64{height:64px;width:64px}.table{background-color:#f3f7fb;color:#363636}.table td{border:solid #d3dee9;border-width:0 0 2px;font-size:14px;padding:15px;vertical-align:middle}.table td.is-primary{background-color:#f15b3e;border-color:#f15b3e;color:#fff}.table td.is-dark{background-color:#0c0016;border-color:#0c0016;color:#fff}.table td.is-dark-gray{background-color:#333;border-color:#333;color:#fff}.table td.is-selected{background-color:#f15b3e;color:#fff;height:80px;text-align:center;vertical-align:middle;width:33%}.table td.is-selected a{color:currentColor}.table td.is-primary-blue{background-color:#2a394e!important}.table tr.is-selected{background-color:#f15b3e;color:#fff}.table tr.is-selected a{color:currentColor}.table tr.is-selected td{border-color:#fff;color:currentColor}.table tbody tr:last-child td{border-bottom-width:0}.title{word-break:break-word}.title span{font-weight:inherit}.title{color:#363636;font-size:2rem;font-weight:600;line-height:1.125}.card{background-color:#fff;box-shadow:0 2px 3px rgba(34,34,34,.1),0 0 0 1px rgba(34,34,34,.1);color:#4a4a4a;max-width:100%;position:relative}.level{align-items:flex-start;justify-content:space-between}.level code{border-radius:4px}.level img{display:inline-block;vertical-align:top}.level.is-mobile{display:flex}@media print,screen and (min-width:769px){.level{display:flex}}.menu{font-size:1rem}.navbar{background-color:#fff;min-height:3.25rem;position:relative;z-index:30}.navbar.is-primary{background-color:#f15b3e;color:#fff}.navbar.is-dark{background-color:#0c0016;color:#fff}.navbar.is-dark-gray{background-color:#333;color:#fff}.navbar>.container{align-items:stretch;display:flex;min-height:3.25rem;width:100%}.navbar-burger{cursor:pointer;display:block;height:3.25rem;margin-left:auto;position:relative;width:3.25rem}.navbar-burger span{background-color:currentColor;display:block;height:1px;left:calc(50% - 8px);position:absolute;transform-origin:center;transition-duration:86ms;transition-property:background-color,opacity,transform;transition-timing-function:ease-out;width:16px}.navbar-burger span:first-child{top:calc(50% - 6px)}.navbar-burger span:nth-child(2){top:calc(50% - 1px)}.navbar-burger span:nth-child(3){top:calc(50% + 4px)}.navbar-burger:hover{background-color:rgba(0,0,0,.05)}.navbar-burger.is-active span:first-child{transform:translateY(5px) rotate(45deg)}.navbar-burger.is-active span:nth-child(2){opacity:0}.navbar-burger.is-active span:nth-child(3){transform:translateY(-5px) rotate(-45deg)}@media screen and (max-width:1087px){.navbar>.container{display:block}}@media screen and (min-width:1088px){.navbar,.navbar-start{align-items:stretch;display:flex}.navbar{min-height:3.25rem}.navbar-burger{display:none}.navbar-start{justify-content:flex-start;margin-right:auto}}.column{display:block;flex-basis:0;flex-grow:1;flex-shrink:1;padding:24px}.columns{margin-left:-24px;margin-right:-24px;margin-top:-24px}.columns:last-child{margin-bottom:-24px}.columns:not(:last-child){margin-bottom:calc(1.5rem - 24px)}.columns.is-centered{justify-content:center}.columns.is-mobile{display:flex}@media print,screen and (min-width:769px){.columns:not(.is-desktop){display:flex}}.hero{align-items:stretch;display:flex;flex-direction:column;justify-content:space-between}.hero .navbar{background:none}.hero.is-primary{background-color:#f15b3e;color:#fff}.hero.is-primary a:not(.button):not(.dropdown-item):not(.tag){color:inherit}.hero.is-primary .title{color:#fff}.hero.is-dark{background-color:#0c0016;color:#fff}.hero.is-dark a:not(.button):not(.dropdown-item):not(.tag){color:inherit}.hero.is-dark .title{color:#fff}.hero.is-dark-gray{background-color:#333;color:#fff}.hero.is-dark-gray a:not(.button):not(.dropdown-item):not(.tag){color:inherit}.hero.is-dark-gray .title{color:#fff}.hero-body{flex-grow:1;flex-shrink:0}.hero-body,.section{padding:3rem 1.5rem}.footer{background-color:#fafafa;padding:3rem 1.5rem 6rem}a{color:#f15b3e}h1,h2,h3,h4,h5,h6{font-weight:545;line-height:1.2}h1{font-size:60px}h2{margin-bottom:14px}h2,h2.features{color:#2a394e;font-size:25px}h2.features{margin-bottom:30px;padding-top:30px;text-align:center}h3{margin-bottom:12px}h3,h3.is-software{color:#f15b3e;font-size:20px}h3.is-software{align-content:center;margin-bottom:4px}h4{color:#2a394e;font-size:18px;margin-bottom:9px}h5{color:#9b9b9b;font-size:14px;text-transform:uppercase}h5,h6{margin-bottom:10px}h6{color:#fff;font-size:20px}p{margin-bottom:1.2em}h1:last-child,h2:last-child,h3:last-child,h4:last-child,h5:last-child,h6:last-child,p:last-child{margin-bottom:0}img{display:inline-block;max-width:100%}img,img.feature-icons{height:auto;vertical-align:middle}img.feature-icons{float:left;margin-right:-100%;max-width:30px}@media(max-width:1023px){img.feature-icons{align-items:center;float:none;height:auto;margin-right:0;max-width:40px;padding-bottom:10px;vertical-align:middle}}pre{background:#282828;border-radius:10px;color:#fff;display:block;font-size:15px;font-weight:400;line-height:1.7;white-space:pre-wrap}.code,pre{word-wrap:normal;font-family:Roboto Mono,monospace}.code{background:#ededed;border-radius:4px;display:inline;font-size:18px;line-height:1;overflow:visible;padding:5px 10px}@media(max-width:767px){.code{font-size:17px}}.no-border-search-submit{border-radius:0;left:-15px;top:20px}.nobullet{list-style-type:none}ul{list-style:none}ul li:before{color:#f15b3e;content:"•";display:inline-block;font-weight:700;margin-left:-1em;width:1em}.item-no-bullet:before{content:""}hr{background-color:#d5d5d5;border:none;display:block;height:2px;margin:1.5rem 0}.columns-sponsors{display:inline-flex}.card{box-shadow:none}.container-center{margin-bottom:40px;text-align:center}.bottom-content{background-color:#2a394e;color:#fff;font-size:50px;font-weight:300;left:-450px;position:relative;text-align:center;top:80px;width:200%}.bottom-content.support-banner-section{left:0;top:0;width:100%}.section-padding-top-0{padding-top:0!important}.container-center-sponsors .columns{flex-wrap:wrap}.container-center-sponsors .columns .columns-sponsors{flex-basis:25%;max-width:25%}.container-center-sponsors .columns .columns-sponsors img{display:block;margin:0 auto}@media screen and (max-width:768px){.container-center-sponsors .columns .columns-sponsors{flex-basis:50%;max-width:50%}}@media screen and (max-width:450px){.container-center-sponsors .columns .columns-sponsors{flex-basis:100%;max-width:100%}}.sponsor-meta-container>.sponsor-inner-container:first-child .columns-sponsors{flex-basis:33%;max-width:33%}.sponsor-meta-container>.sponsor-inner-container:first-child .columns-sponsors img{max-width:188px}@media screen and (max-width:768px){.sponsor-meta-container>.sponsor-inner-container:first-child .columns-sponsors{flex-basis:50%;max-width:50%}}@media screen and (max-width:450px){.sponsor-meta-container>.sponsor-inner-container:first-child .columns-sponsors{flex-basis:100%;max-width:100%}}.sponsor-meta-container>.sponsor-inner-container:nth-child(2) .columns-sponsors img{max-width:160px}.sponsor-meta-container>.sponsor-inner-container:nth-child(3) .columns-sponsors img{max-width:145px}.section-article-simple .foundation-logo{display:block;margin:3rem auto 0;max-width:280px}.section-article-simple .foundation-tagline{margin-bottom:20px;text-align:center}section.section.section-padding-top-0.supporters-section{padding-bottom:0}.container{max-width:1170px;padding-left:15px;padding-right:15px;width:auto}.container-medium{max-width:1123px}.container-thin{max-width:895px}.container-thin-alt{max-width:881px}.main-border{border-top:15px solid #f15b3e}.main .main-about{color:#222;font-size:20px;font-weight:400;margin-bottom:29px}.main .main-inner{padding:42px 0 81px}.main .main-container{display:flex;justify-content:space-between;margin-bottom:52px}.main .main-container:last-child{margin-bottom:0}@media(max-width:767px){.main .main-container{display:block}.main .main-inner{padding:42px 0}}.top-line{background-color:#2a394e;height:15px;width:100%}.content{flex:1 1 100%;max-width:100%}@media(max-width:767px){.content,.content:not(:last-child){margin-bottom:0}}.sidebar{flex:0 0 227px;margin-left:75px;max-width:227px}@media(max-width:1023px){.sidebar{margin-left:50px}}@media(max-width:767px){.sidebar{flex:1 1 100%;margin-left:0;max-width:100%}}.header{position:relative;z-index:50}.bar{background:#333;color:#fff;padding:7px 0}.bar .bar-btn{border:1px solid #fff;border-radius:4px;color:#fff;display:inline-block;flex:0 0 auto;font-size:12px;font-weight:700;line-height:1.2;padding:4px 14px;text-transform:uppercase;transition:background .3s,border-color .3s;vertical-align:middle}.bar .bar-btn:hover{background:#f15b3e;border-color:#fff}.bar .bar-logo{flex:0 0 32px;max-width:32px}.bar .bar-inner{align-items:center;display:flex;gap:15px;justify-content:center}.bar .bar-entry{margin:0 22px}.bar .bar-entry p{font-size:16px}@media(max-width:768px){.bar{padding:15px 0}.bar .bar-inner{flex-wrap:wrap;justify-content:left;text-align:left}.bar .bar-entry,.bar .bar-logo{flex:1 1 30%;margin-right:10px}.bar .bar-entry{margin:10px 0}}.bar.top-bar-brand-color{background-color:#f15b3e}.button{height:auto;padding:11px 45px;text-transform:uppercase;transition:background .3s}.button.is-rounded{margin-bottom:15px;padding:11px 43px;text-decoration:none}.button .ico{display:inline-block;font-size:0;line-height:0;margin-left:15px;vertical-align:middle}.button.is-primary,.button.is-primary-dark{background:#f15b3e;border:#f15b3e;color:#fff}.link{display:inline-block;font-size:14px;font-weight:500;text-transform:uppercase;vertical-align:middle}.link.is-dark,.link.is-dark-gray,.link.is-primary{color:#141f47}.link .ico{display:inline-block;font-size:0;line-height:0;margin-left:15px;vertical-align:middle}.nav{padding:22px 0 18px}.nav .nav-content,.nav .nav-inner,.nav .nav-menu{align-items:center;display:flex;justify-content:flex-start}.nav .nav-content ul,.nav .nav-inner ul,.nav .nav-menu ul{list-style-type:none;list-style:none;margin:0}.nav .nav-content ul li:before,.nav .nav-inner ul li:before,.nav .nav-menu ul li:before{content:""}.nav .nav-content a,.nav .nav-inner a,.nav .nav-menu a{color:#2a394e;text-transform:uppercase}.nav .nav-content{flex:1 1 100%;justify-content:space-between;max-width:100%;padding-left:40px}.nav .nav-menu{color:#222;font-size:12px;font-weight:400;text-transform:uppercase}.nav .nav-menu a{color:#2a394e;display:inline-block;transition:color .3s}.nav .nav-menu a:hover{color:#f15b3e}.nav .nav-menu li+li{margin-left:44px}.nav .nav-brand{flex:0 0 auto;padding-right:40px}.nav .navbar-burger{display:none}@media(max-width:1023px){.nav .nav-inner{flex-wrap:wrap;justify-content:center;text-align:center}.nav .nav-brand{flex:1 1 100%;margin-bottom:20px;padding-right:0}.nav .nav-content{flex-wrap:wrap;justify-content:center;padding-left:0}.nav .nav-menu{flex:1 1 100%;justify-content:center;margin-bottom:0;max-width:100%}}@media(max-width:767px){.nav{background:#fff;padding:10px 0;position:relative}.nav .nav-brand{flex:0 0 auto;margin-bottom:0;padding-right:0}.nav .navbar-burger{display:block}.nav .nav-menu{display:block;font-size:14px}.nav .nav-menu a{margin-bottom:10px}.nav .nav-menu li+li{margin-left:0;margin-top:5px}.nav .nav-content{background:#fff;border-bottom:0;border-radius:0;border-top:1px solid #9b9b9b;left:0;opacity:0;padding:20px 10px;position:absolute;top:calc(100% + 10px);transition:visibility .3s,opacity .3s,z-index .3s;visibility:hidden;width:100%;z-index:-1}.nav .nav-content.is-active{opacity:1;visibility:visible;z-index:30}}.padding-top-5{padding-top:7px}.hero{font-size:20px;line-height:1.25}.hero .hero-title{color:#f15b3e}.hero-intro .hero-content{align-items:center;display:flex;justify-content:flex-start}.hero-intro .hero-body{background-color:#fff;padding:60px 0 0}.hero-intro .hero-title{font-size:42px;font-weight:500;max-width:50%;padding-right:24px}.hero-intro .hero-entry{color:#4a4a4a;max-width:460px;padding-left:36px;position:relative}.hero-intro .hero-entry:before{background:#4a4a4a;content:"";height:50px;left:0;position:absolute;top:50%;transform:translateY(-50%);width:1px}@media(max-width:767px){.hero-intro .hero-content{display:block}.hero-intro .hero-body{padding:45px 0}.hero-intro .hero-title{max-width:100%}.hero-intro .hero-entry{margin-top:20px;max-width:100%;padding-left:0;padding-top:20px}.hero-intro .hero-entry:before{background:#4a4a4a;height:1px;top:0;transform:translateY(0);width:100px}}.hero-main{text-align:center}.hero-main .hero-title{color:#fff;font-size:50px;font-weight:300}.hero-main .hero-body{padding:67px 0 65px}.hero-main .hero-content{margin:0 auto;max-width:780px}@media(max-width:767px){.hero-main .hero-title{font-size:30px}.hero-main .hero-body{padding:62px 0}}.hero-image{background-position:50%;background-repeat:no-repeat;background-size:cover;position:relative}.hero-image.is-primary:after{content:"";height:100%;left:0;position:absolute;top:0;width:100%}.hero-image .hero-body{position:relative;z-index:10}.hero-subhead{font-size:18px;font-weight:400;padding-bottom:35px;padding-top:4px}.section{padding:78px 0 54px}.section.is-primary{background-color:#f15b3e;border-color:transparent;color:#fff}.section.is-dark{background-color:#0c0016;border-color:transparent;color:#fff}.section.is-dark-gray{background-color:#333;border-color:transparent;color:#fff}.section .section-body{margin-bottom:75px}.section .section-body:last-child{margin-bottom:0}@media(max-width:767px){.section{padding:45px 0}.section .section-body{margin-bottom:50px}}.section-article{padding:50px 0}.section-modified{padding:69px 0 75px}.section-modified .section-inner{margin:0 auto;max-width:1052px}@media(max-width:768px){.section-modified{padding:45px 0}}.section-article-simple{padding:60px 0 73px}@media(max-width:767px){.section-article-simple{padding:45px 0}}.section-article-single{padding:66px 0 59px}@media(max-width:767px){.section-article-single{padding:30px 0}}.features-section{background-color:#f5f6f7;padding:0 15px 60px}.software-icon{float:left;padding-right:30px;vertical-align:middle}.box-text{padding-top:0}.video-wrapper{height:0;margin-bottom:30px;margin-top:30px;padding-bottom:56.25%;padding-top:25px;position:relative}.video-wrapper iframe{height:100%;left:0;position:absolute;top:0;width:100%}.article{display:flex}.article .article-content{flex:1 1 100%;font-size:1.2em;line-height:1.3em;max-width:100%;padding:6px 20px 6px 47px}@media(max-width:1023px){.article{display:flex;flex-direction:column-reverse}.article .article-content{flex:1 1 100%;margin-bottom:30px;max-width:100%;padding:0}}.article-simple{color:#4a4a4a;font-size:16px;line-height:1.8;margin-bottom:62px}.article-simple:last-child{margin-bottom:0}.article-simple p{margin-bottom:20px}.article-simple p:last-child{margin-bottom:0}.article-simple p+img{margin-top:18px}.article-simple img{margin-bottom:0}.article-simple img:last-child{margin-bottom:30}.article-simple a{color:#f15b3e;text-decoration:underline}.article-simple a:hover{text-decoration:none}.article-simple a .a-primary-blue{color:#2a394e;text-decoration:underline}.article-simple a .a-primary-blue:hover{text-decoration:none}.article-simple .a-primary-blue{color:#2a394e;text-decoration:underline}.article-simple .a-primary-blue:hover{text-decoration:none}@media(max-width:767px){.article-simple{font-size:16px;margin-bottom:30px}}.article-excerpt{color:#4a4a4a;font-size:17px;line-height:1.6;margin-bottom:45px}.article-excerpt:last-child{margin-bottom:0}.article-excerpt .article-excerpt-title{color:#f15b3e;font-size:25px;font-weight:500;margin-bottom:16px}.article-excerpt .article-excerpt-title a{color:inherit;display:block}.article-excerpt .article-excerpt-title a:hover{text-decoration:underline}.article-excerpt .article-excerpt-entry{margin-bottom:18px}.article-excerpt .article-excerpt-meta{color:#797979;font-size:14px}.article-excerpt .article-excerpt-meta a{color:inherit;text-decoration:underline}.article-excerpt .article-excerpt-meta a:hover{text-decoration:none}.article-single{font-size:20px;line-height:1.8}.article-single .article-single-head{margin-bottom:44px}.article-single .article-single-title{color:#f15b3e;font-size:42px;font-weight:300;margin-bottom:17px}.article-single .article-single-entry{margin-bottom:47px}.article-single .article-single-entry h1{font-size:25px;margin-bottom:14px}.article-single .article-single-entry h2{font-size:20px}.article-single .article-single-entry blockquote{border-left:3px solid #f15b3e;margin-bottom:35px;margin-left:20px;padding-left:20px}.article-single .article-single-entry blockquote li{display:inline-flex}.article-single .article-single-entry pre{margin-bottom:35px;margin-left:20px}.article-single .article-single-entry ol{list-style:auto;list-style-type:decimal;margin-bottom:20px;margin-left:20px}.article-single .article-single-meta{color:#797979;font-size:16px}.article-single .article-single-meta a{color:inherit;text-decoration:underline}.article-single .article-single-meta a:hover{text-decoration:none}@media(max-width:767px){.article-single{font-size:16px}.article-single .article-single-title{font-size:30px}.article-single .article-single-entry{margin-bottom:25px}.article-single .article-single-meta{font-size:14px}.article-single .article-single-head{margin-bottom:20px}}.list-numeric{color:#4a4a4a;font-size:14px;padding-left:18px;padding-top:0}.list-numeric ul{list-style-type:none;margin:0 0 0 24px}.list-numeric .list-numeric-title{color:#2a394e;font-weight:500;margin-bottom:40px;padding-left:38px;text-align:center}.list-numeric h6{color:#f15b3e;font-weight:500;margin-bottom:5px}.list-numeric p{margin-bottom:8px}.list-numeric li+li{margin-top:45px}.list-numeric li{padding-left:87px;position:relative}.list-numeric li:before{background:#f15b3e;border-radius:50%;color:#fff;content:counters(number,".") " ";counter-increment:number;font-size:35px;font-weight:700;height:67px;left:0;line-height:67px;position:absolute;text-align:center;top:50%;transform:translateY(-50%);width:67px}.list-numeric a{color:#f15b3e;font-size:14px;text-decoration:underline;word-break:break-all}.list-numeric a:hover{text-decoration:none}@media(max-width:768px){.list-numeric{padding:0}}@media(max-width:767px){.list-numeric .list-numeric-title{padding:0}.list-numeric li+li{margin-top:20px}.list-numeric li{padding-left:55px}.list-numeric li:before{font-size:20px;height:45px;line-height:45px;width:45px}}ul{counter-reset:number;list-style-type:none;margin-bottom:20px;margin-left:20px}.box{background:#f5f6f7;border-radius:8px;border-style:solid;border-width:16px 0 0;box-shadow:none;color:#222;font-size:16px;font-weight:400;padding:30px}.box.is-primary{border-color:#f15b3e}.box.is-dark{border-color:#0c0016}.box.is-dark-gray{border-color:#333}.box .box-title{color:#f15b3e;margin-bottom:25px}.box .box-entry{margin-bottom:70px}.box .box-entry:last-child{margin-bottom:0}.box .box-actions{text-align:center}@media(max-width:767px){.box{font-size:16px;padding:25px 20px}.box .box-title{margin-bottom:15px;text-align:left}.box .box-entry{margin-bottom:20px}.box .box-actions{text-align:left}}.container1{background-color:#2a394e;height:59px;margin-bottom:30px;max-width:1170px;padding-left:15px;padding-right:15px;width:auto}.container1 h2.features{color:#fff;font-size:26px;margin-bottom:25px;padding-bottom:15px;padding-top:14px;text-align:center}.container2{background-color:#f5f6f8;margin-bottom:50px;max-width:1170px;padding-left:15px;padding-right:15px;text-align:center;width:auto}.container2 h2.features{color:#fff;font-size:25px;margin-bottom:25px;padding-bottom:15px;padding-top:15px;text-align:center}.container2 h4{color:#2a394e;font-weight:800}.container2 span{display:block}.footer{color:#d5d5d5;font-size:14px;padding:69px 0}.footer.is-primary{background-color:#f15b3e;color:#fff}.footer.is-dark{background-color:#0c0016;color:#fff}.footer.is-dark-gray{background-color:#333;color:#fff}.footer .footer-content{flex:0 0 450px;max-width:450px}.footer .footer.is-dark a{color:#fff}.footer .footer-aside{align-items:end;display:flex;flex-direction:column;margin-left:auto;max-width:417px;text-align:right}.footer .footer-title{color:#fff;font-size:16px;font-weight:700;margin-bottom:19px}.footer .footer-list{color:#d5d5d5;font-size:14px;font-weight:400;list-style-type:none;margin:0}.footer .footer-list a{color:inherit}.footer .footer-list a:hover{text-decoration:underline}.footer .footer-brand{background:#fff;padding:10px;width:100px}.footer .footer-brand img{width:100%}.footer .footer-entry{margin-bottom:53px}.footer .footer-entry p{margin-bottom:10px}.footer .footer-entry a{color:#fff;text-decoration:underline}.footer .footer-entry a:focus,.footer .footer-entry a:hover{color:#f15b3e}@media(max-width:768px){.footer{padding:45px 0}.footer .footer-aside,.footer .footer-content{max-width:100%;text-align:center}.footer .footer-aside{align-items:baseline}.footer .footer-entry{margin-bottom:20px}}@media(max-width:767px){.footer .columns.is-mobile{flex-wrap:wrap;margin:0}.footer .columns.is-mobile .column{flex:1 1 100%;max-width:100%;padding:0 0 30px}.footer .columns.is-mobile .column:last-child{padding-bottom:0}.footer .footer-title{margin-bottom:7px}.footer .footer-aside,.footer .footer-content{text-align:left}}.widget{border-bottom:1px solid #d4d4d4;list-style-type:none;margin:0 0 35px;padding-bottom:28px}.widget .widget-title{color:#959595;font-size:16px;margin-bottom:12px;text-transform:uppercase}.widget .widget-list{color:#4a4a4a;font-size:14px;font-weight:500;list-style-type:none;margin:0}.widget .widget-list li+li{margin-top:5px}.widget .widget-list a{color:inherit;transition:color .3s}.widget .widget-list a:hover{color:#f15b3e;text-decoration:underline}body{display:flex;flex-direction:column;min-height:100vh}.is-green{color:#2a394e}.search-content{background-color:#2a394e;color:#fff;font-size:50px;font-weight:300;text-align:center}.search-content .search-content-title{color:#fff;font-size:20px;font-weight:650;line-height:1.2}.search-content .search-content-subtitle{color:#fff;font-size:18px;font-weight:300;line-height:1.2;margin-bottom:21px}.search-content .button.no-border-search-submit{border-radius:50px;height:42px;top:0}.search-content .button.no-border-search-submit a{color:#fff}@media(max-width:767px){.search-content .search-content{font-size:30px}.search-content .search-content-title{font-size:20px}}.header-anchor{display:none}[data-rmiz]{position:relative}[data-rmiz-ghost]{pointer-events:none;position:absolute}[data-rmiz-btn-unzoom],[data-rmiz-btn-zoom]{-webkit-appearance:none;-moz-appearance:none;appearance:none;background-color:rgba(0,0,0,.7);border:none;border-radius:50%;box-shadow:0 0 1px hsla(0,0%,100%,.5);color:#fff;height:40px;margin:0;outline-offset:2px;padding:9px;touch-action:manipulation;width:40px}[data-rmiz-btn-zoom]:not(:focus):not(:active){clip:rect(0 0 0 0);clip-path:inset(50%);height:1px;overflow:hidden;pointer-events:none;position:absolute;white-space:nowrap;width:1px}[data-rmiz-btn-zoom]{cursor:zoom-in;inset:10px 10px auto auto;position:absolute}[data-rmiz-btn-unzoom]{cursor:zoom-out;inset:20px 20px auto auto;position:absolute;z-index:1}[data-rmiz-content=found] [data-zoom],[data-rmiz-content=found] [role=img],[data-rmiz-content=found] img,[data-rmiz-content=found] svg{cursor:zoom-in}[data-rmiz-modal]::backdrop{display:none}[data-rmiz-modal][open]{background:transparent;border:0;height:100vh;height:100dvh;margin:0;max-height:none;max-width:none;overflow:hidden;padding:0;position:fixed;width:100vw;width:100dvw}[data-rmiz-modal-overlay]{inset:0;position:absolute;transition:background-color .3s}[data-rmiz-modal-overlay=hidden]{background-color:hsla(0,0%,100%,0)}[data-rmiz-modal-overlay=visible]{background-color:#fff}[data-rmiz-modal-content]{height:100%;position:relative;width:100%}[data-rmiz-modal-img]{cursor:zoom-out;image-rendering:high-quality;position:absolute;transform-origin:top left;transition:transform .3s}@media (prefers-reduced-motion:reduce){[data-rmiz-modal-img],[data-rmiz-modal-overlay]{transition-duration:.01ms!important}}</style><style>.gatsby-image-wrapper{position:relative;overflow:hidden}.gatsby-image-wrapper picture.object-fit-polyfill{position:static!important}.gatsby-image-wrapper img{bottom:0;height:100%;left:0;margin:0;max-width:none;padding:0;position:absolute;right:0;top:0;width:100%;object-fit:cover}.gatsby-image-wrapper [data-main-image]{opacity:0;transform:translateZ(0);transition:opacity .25s linear;will-change:opacity}.gatsby-image-wrapper-constrained{display:inline-block;vertical-align:top}</style></head><body><div id="___gatsby"><div style="outline:none" tabindex="-1" id="gatsby-focus-wrapper"><div><nav class="navbar___3SVld"><div class="container___E0DqP container"><div class="brand___ZOIKE"><div class="logo___1fq4T"><img src="data:image/svg+xml,%3csvg width='20' height='20' viewBox='0 0 20 20' fill='none' xmlns='http://www.w3.org/2000/svg'%3e %3cg clip-path='url(%23clip0_2_15)'%3e %3cpath d='M0 3.33643V4.99999H11.4684L0 16.4684L1.1803 17.6487L15.4926 3.33643H0Z' fill='%23F7B749'/%3e %3cpath d='M17.1561 1.66357L18.829 0H0V1.66357H17.1561Z' fill='%23ED362F'/%3e %3cpath d='M18.3364 2.84387V20H20V1.1803L18.3364 2.84387Z' fill='%2343B85C'/%3e %3cpath d='M16.6729 20V4.51672L2.3606 18.8197L3.54089 20L15 8.54089V20H16.6729Z' fill='%232CB4E2'/%3e %3c/g%3e %3cdefs%3e %3cclipPath id='clip0_2_15'%3e %3crect width='20' height='20' fill='white'/%3e %3c/clipPath%3e %3c/defs%3e %3c/svg%3e" alt="OpenInfra"/></div>An OpenInfra Foundation Project</div><div class="menu___2CAGc"><img class="menuIcon___2xOq1" src="data:image/svg+xml,%3csvg width='20' height='20' viewBox='0 0 20 20' fill='none' xmlns='http://www.w3.org/2000/svg'%3e %3cpath d='M4 0H0V4H4V0Z' fill='white'/%3e %3cpath d='M12 0H8V4H12V0Z' fill='white'/%3e %3cpath d='M20 0H16V4H20V0Z' fill='white'/%3e %3cpath d='M4 8H0V12H4V8Z' fill='white'/%3e %3cpath d='M12 8H8V12H12V8Z' fill='white'/%3e %3cpath d='M20 8H16V12H20V8Z' fill='white'/%3e %3cpath d='M4 16H0V20H4V16Z' fill='white'/%3e %3cpath d='M12 16H8V20H12V16Z' fill='white'/%3e %3cpath d='M20 16H16V20H20V16Z' fill='white'/%3e %3c/svg%3e" alt="Menu"/></div></div></nav><div class="bar is-dark-gray top-bar-brand-color"><div class="container"><div class="bar-inner"><div class="bar-entry"><p>Learn how NVIDIA is using Kata Containers to support AI/ML workloads!</p></div><a class="bar-btn" href="https://www.youtube.com/watch?v=a3HzBmPuw5g">WATCH NOW</a></div></div></div><nav class="nav navbar is-transparent" role="navigation" aria-label="main-navigation"><div class="container"><div class="nav-inner"><div class="nav-brand"><a title="Logo" href="/"><img src="/static/logo-db9de544cdd990e1f6e22542da17976b.svg" alt="Kata"/></a></div><div class="navbar-burger burger " data-target="navMenu"><span></span><span></span><span></span></div><div id="navMenu" class="nav-content "><ul class="nav-menu nobullet navbar-start has-text-centered"><li><a href="/learn/">Learn</a></li><li><a href="/software/">Software</a></li><li><a href="/docs/">Docs</a></li><li><a href="/community/">Community</a></li><li><a href="/use-cases/">Users</a></li><li><a href="/supporters/">Supporters</a></li><li><a href="/blog/">Blog</a></li></ul></div></div></div></nav><div><main class="main main-border"><section class="section section-article-single"><div class="container container-thin-alt"><div class="section-body"><div class="article-single"><div class="article-single-head"><h3 class="article-single-title">Inject Workloads with Kata Containers in Istio</h3><div class="article-single-meta"><p>By <a href="/author/kata-containers/">Kata Containers</a> on 13/03/2023</p></div></div><div class="article-single-entry"><div class="content custom"><div><p>Written by <a href="https://github.com/zhlsunshine">Steve(Huailong) Zhang</a></p> <p><a href="https://github.com/kata-containers"><strong>Kata Containers</strong></a>, which is a merger of two existing open source projects - <strong>Intel Clear Containers</strong> and <strong>Hyper runV</strong>, is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.</p> <p>Based on the definition above, it’s natural for me to think about how to achieve the Kata Containers as one of multiple container runtimes in Istio to inject the workload. The good news is that I successfully deployed it in my environment, and this blog will introduce what benefits we can get from Kata Containers and how to deploy it.</p> <h1>What’s the benefit of using Kata Containers?</h1> <p>Kata Containers is designed to provide greater isolation between containers while still maintaining the performance and efficiency provided by other runtimes. There is one critical difference for Kata Containers to be a special container runtime: Kata runtime enforces a deeper level of isolation between containers than other runtimes by following below two points:</p> <ul> <li>Each pod runs its own kernel instead of sharing the host system’s kernel with the host and other containers using <code>cgroups</code> in Kata</li> <li>Kata Containers can take advantage of security features provided by hardware-level virtualization (meaning virtualization that is built into CPUs and made available using VT extensions)</li> </ul> <p>However, it’s different from common virtual machines to take a minute or two for starting and wasting a fair amount of hardware resources on establishing container isolation, Kata starts just as fast and consumes resources just as efficiently as other containers. The containers become more secure with the lowest cost：</p> <p><span class="gatsby-resp-image-wrapper" style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1069px; " > <span class="gatsby-resp-image-background-image" style="padding-bottom: 28.7109375%; position: relative; bottom: 0; left: 0; background-image: url('data:image/webp;base64,UklGRuwAAABXRUJQVlA4WAoAAAAQAAAAEwAABQAAQUxQSDcAAAABP6CgkaQ2+r0DLpCANiIinljcOh+MIkkK80MCDrCABRSchY6E8f+Mg4j+B2y4Va/q+wtrZuYAAFZQOCCOAAAAUAQAnQEqFAAGAD7RVqZLqCSjobAIAQAaCWYAnTKCgVvJyAstbWvvfrsuYAD+th0e6MW4gc3hySRhozul5htj666QPThLtZW43M6u5YMx/XoDmPZuMBQDMSxOwLwgG0CuXeI6il83iN/n29iuvX55oEFCabQ5/mEXByggPEC0G79td4v+fGkYC3xfowGAAA=='); background-size: cover; display: block;" ></span> <img class="gatsby-resp-image-image" alt="1 q7K7H fGSzfEYUCKKHuHIA" title="" src="/static/f369bb5d442733a5665d324a165ebb3b/b8544/1_q7K7H-fGSzfEYUCKKHuHIA.webp" srcset="/static/f369bb5d442733a5665d324a165ebb3b/bd5dd/1_q7K7H-fGSzfEYUCKKHuHIA.webp 512w, /static/f369bb5d442733a5665d324a165ebb3b/a9a89/1_q7K7H-fGSzfEYUCKKHuHIA.webp 1024w, /static/f369bb5d442733a5665d324a165ebb3b/b8544/1_q7K7H-fGSzfEYUCKKHuHIA.webp 1069w" sizes="(max-width: 1069px) 100vw, 1069px" style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;" loading="lazy" decoding="async" /> </span></p> <h1>How to deploy workload injection with Kata Containers in Istio:</h1> <p>Environment Prepared</p> <ul> <li>Containerd 1.5.6</li> <li>Kata Runtime v3.0.2</li> <li>Kubernetes Cluster via kubeadm (do not use Kind) v1.23</li> <li>Istio v1.17-dev</li> </ul> <h2>Install Kata Containers</h2> <p>There are 6 methods to install Kata Containers via the installation guides found <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/install/README.md">here</a> and <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/install/README.md">here</a>. I have tried two of them (Using snap and Manual), and I recommend the <code>manual</code> method because it’s mess to me when using snap. So let’s get into <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/install/container-manager/containerd/containerd-install.md">Manual guides</a>.</p> <p>Key highlights:</p> <ol> <li> <p>After untarring the Kata Containers package, move all files into <code>/opt/kata</code> or <code>/$HOME/opt/kata</code> directory, depending on your system & user. Once complete, there should be four files — <code>bin</code> , <code>libexec</code>, <code>runtime-rs</code>, and <code>share</code> under <code>/opt/kata</code> .</p> </li> <li> <p>Copy <code>/opt/kata/share/defaults/kata-containers/configuration.toml</code> into <code>/etc/kata-containers/configuration.toml</code> Note: Please choose the corrected configuration file for you, and create the <code>/etc/kata-containers</code> directory if it does not exist.</p> </li> <li> <p>Create 5 symbolic links (symlinks) for Kata Containers installation files by following commands:</p> <pre>$ ln -s /opt/kata/bin/kata-runtime /usr/local/bin/kata-runtime</pre> <pre>$ ln -s /opt/kata/bin/containerd-shim-kata-v2 /usr/local/bin/containerd-shim-kata-v2</pre> <pre>$ ln -s /opt/kata/bin/kata-monitor /usr/local/bin/kata-monitor</pre> <pre>$ ln -s /opt/kata/bin/kata-collect-data.sh /usr/local/bin/kata-collect-data.sh</pre> <pre>$ ln -s /opt/kata/bin/qemu-system-x86_64 /usr/local/bin/qemu-system-x86_64</pre> </li> </ol> <p>Please refer to <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/install/README.md">Kata Containers installation guides</a> for more detail.</p> <h2>Configure Containerd correctly</h2> <p>This content is included in <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/how-to/containerd-kata.md#configuration">Configuring Containerd to use Kata Containers</a>, however, I just want to simplify the <code>plugins</code> configuration for Containerd by using <a href="https://kubernetes.io/docs/concepts/containers/runtime-class/">RuntimeClass</a> as shown below:</p> <pre><code>[plugins."io.containerd.grpc.v1.cri".containerd] default_runtime_name = "runc" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" privileged_without_host_devices = true [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata.options] ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration.toml" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] SystemdCgroup = true </code></pre> <p>In this configuration, I define two types of runtime: <code>runc</code> and <code>kata</code> and default by <code>runc</code>.</p> <p>Note: If Containerd configuation is changed, you will need to reload & restart services using the commands <code>sudo systemctl daemon-reload</code> and <code>sudo systemctl restart containerd</code>.</p> <h2>Configure kubelet correctly</h2> <p>This content is included in <a href="https://github.com/kata-containers/kata-containers/blob/main/docs/how-to/how-to-use-k8s-with-containerd-and-kata.md#configure-kubelet-to-use-containerd">Configure kubelet to use Kata Containers</a>, the configuration file <code>/etc/systemd/system/kubelet.service.d/10-kubeadm.conf</code> is below:</p> <pre><code>$ Environment="KUBELET_EXTRA_ARGS= — container-runtime=remote — container-runtime-endpoint=unix:///run/containerd/containerd.sock — cgroup-driver=systemd" </code></pre> <h1>Inject workloads with Kata Containers in Istio</h1> <p>Generally, there should be no difference when installing k8s cluster and Istio, demonstrated below as I install cluster via <code>kubeadm</code> command:</p> <pre><code>$ kubeadm init — cri-socket=unix:///run/containerd/containerd.sock — pod-network-cidr=10.244.0.0/16 — v=5 — ignore-preflight-errors=all` </code></pre> <p><em>Then install Istio via istioctl command</em> <code>istioctl install -y</code></p> <p>Based on the <strong>Containerd</strong> configuration from before, <code>runc</code> is the default container runtime, which can be verified with the command: <code>$ sudo systemctl status containerd</code></p> <p><span class="gatsby-resp-image-wrapper" style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1869px; " > <span class="gatsby-resp-image-background-image" style="padding-bottom: 31.25%; position: relative; bottom: 0; left: 0; background-image: url('data:image/webp;base64,UklGRlYAAABXRUJQVlA4IEoAAABwAwCdASoUAAYAPtFUo0uoJKMhsAgBABoJQAALvh5W9VaVhAAA/vSZeIMHoTwmJi9c/0H0bqPTemyNzbJnuWvlr8RVQx3sNYAAAA=='); background-size: cover; display: block;" ></span> <img class="gatsby-resp-image-image" alt="1 tOj55ay6VP4khFj2RE v g" title="" src="/static/99234fa7434a3e734836068a3f0cea1b/eaccf/1_tOj55ay6VP4khFj2RE-v_g.webp" srcset="/static/99234fa7434a3e734836068a3f0cea1b/bd5dd/1_tOj55ay6VP4khFj2RE-v_g.webp 512w, /static/99234fa7434a3e734836068a3f0cea1b/a9a89/1_tOj55ay6VP4khFj2RE-v_g.webp 1024w, /static/99234fa7434a3e734836068a3f0cea1b/eaccf/1_tOj55ay6VP4khFj2RE-v_g.webp 1869w" sizes="(max-width: 1869px) 100vw, 1869px" style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;" loading="lazy" decoding="async" /> </span></p> <p>I use <a href="https://kubernetes.io/docs/concepts/containers/runtime-class/">RuntimeClass</a> to launch the Kata Containers, using the <code>yaml</code> file <code>kata-runtimeclass.yaml</code> below:</p> <pre><code>apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: kata-runtime handler: kata </code></pre> <p>The <code>RuntimeClass</code> <code>CustomResource</code> (CR) name is <code>kata-runtime</code> and the <code>handler</code> field is specified as <code>kata</code>. Create this CR by command:</p> <pre><code>$ kubectl apply -f kata-runtimeclass.yaml </code></pre> <p>I use <code>httpbin</code> as an example by using <code>httpbin.yaml</code>, however, there should be a little change for it, and the final yaml is below:</p> <pre><code>apiVersion: v1 kind: ServiceAccount metadata: name: httpbin - - apiVersion: v1 kind: Service metadata: name: httpbin labels: app: httpbin service: httpbin spec: ports: - name: http port: 8000 targetPort: 80 selector: app: httpbin - - apiVersion: apps/v1 kind: Deployment metadata: name: httpbin spec: replicas: 1 selector: matchLabels: app: httpbin version: v1 template: metadata: labels: app: httpbin version: v1 spec: runtimeClassName: kata-runtime serviceAccountName: httpbin containers: - image: docker.io/kennethreitz/httpbin imagePullPolicy: IfNotPresent name: httpbin ports: - containerPort: 80 </code></pre> <p>Be mindful of the presence of an extra <code>runtimeClassName: kata-runtime</code> field in the <code>containers</code> section of the Deployment. I have already defined the <code>RuntimeClass</code> CR as <code>kata-runtime</code>. Another important note is that the <code>httpbin</code> ServiceAccount is required, because Kata Containers needs a cluster role.</p> <p>Now it is time to deploy this service using the following command:</p> <pre><code>$ kubectl apply -f <(istioctl kube-inject -f httpbin-hsm.yaml) </code></pre> <p>Verify the workload as demonstrated below:</p> <p><span class="gatsby-resp-image-wrapper" style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1809px; " > <span class="gatsby-resp-image-background-image" style="padding-bottom: 38.8671875%; position: relative; bottom: 0; left: 0; background-image: url('data:image/webp;base64,UklGRkgAAABXRUJQVlA4IDwAAADQAgCdASoUAAgAPtFWo0uoJKMhsAgBABoJZwAAfj4AAP7yOCQZMXrAoRcx5C4ahaI4yIJFKVbYDN1uAAA='); background-size: cover; display: block;" ></span> <img class="gatsby-resp-image-image" alt="1 Lt3zxarW27GOvcuJda1wtA" title="" src="/static/c76b21447f2596a3b1aea373d4371336/300bb/1_Lt3zxarW27GOvcuJda1wtA.webp" srcset="/static/c76b21447f2596a3b1aea373d4371336/bd5dd/1_Lt3zxarW27GOvcuJda1wtA.webp 512w, /static/c76b21447f2596a3b1aea373d4371336/a9a89/1_Lt3zxarW27GOvcuJda1wtA.webp 1024w, /static/c76b21447f2596a3b1aea373d4371336/300bb/1_Lt3zxarW27GOvcuJda1wtA.webp 1809w" sizes="(max-width: 1809px) 100vw, 1809px" style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;" loading="lazy" decoding="async" /> </span></p> <p>There should be a new Runtime Class Name property, as is shown in the above red rectangle box.</p> <p><span class="gatsby-resp-image-wrapper" style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1863px; " > <span class="gatsby-resp-image-background-image" style="padding-bottom: 34.9609375%; position: relative; bottom: 0; left: 0; background-image: url('data:image/webp;base64,UklGRmAAAABXRUJQVlA4IFQAAACQAwCdASoUAAcAPtFWpEuoJKOhsAgBABoJQBadBDwzAow/YEVgAP7zMEYsoN9/L7M+DiiXH0Y9yk5IPKOXsn9kCiqq6TAO0dQyHvgDqAAVv52AAAA='); background-size: cover; display: block;" ></span> <img class="gatsby-resp-image-image" alt="1 H1WS3UwDBdUJoAWub2Lmfg" title="" src="/static/9ca32e4d1944a066fe5d265020918253/2fa9d/1_H1WS3UwDBdUJoAWub2Lmfg.webp" srcset="/static/9ca32e4d1944a066fe5d265020918253/bd5dd/1_H1WS3UwDBdUJoAWub2Lmfg.webp 512w, /static/9ca32e4d1944a066fe5d265020918253/a9a89/1_H1WS3UwDBdUJoAWub2Lmfg.webp 1024w, /static/9ca32e4d1944a066fe5d265020918253/2fa9d/1_H1WS3UwDBdUJoAWub2Lmfg.webp 1863w" sizes="(max-width: 1863px) 100vw, 1863px" style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;" loading="lazy" decoding="async" /> </span></p> <p>Besides the Containerd <code>containerd-shim-runc-v2</code>, there are also other processes for Kata Containers shown in the above red rectangle box, such as <code>containerd-shim-kata-v2</code>, <code>virtiofsd</code> and <code>qemu-system-x86_64</code>. This is because I deploy a service which requires Kata Containers to inject in Cluster.</p> <h1>Conclusion</h1> <ul> <li>Basically, there are not many differences for using Kata Containers with other generic container runtimes in Istio from my use case: deploy <code>httpbin</code> and <code>bookinfo</code>, but we still need to verify more other things, such as network CNI situations, Istio CNI enablement and so on.</li> <li>There may be multiple container runtimes according to different requirements in Istio later in the same environment at the same time, and we need to be aware of this.</li> </ul> <h1>About the author</h1> <p><a href="https://github.com/zhlsunshine">Steve(Huailong) Zhang</a> has worked for Alcatel-Lucent, Baidu and IBM to engage in cloud computing research and development. Huailong is currently working for Intel China as a cloud-native software engineer, focusing on cloud-native service mesh technical fields. He is an Istio maintainer and Linkerd developer. He also leads and participates in Istio’s Dual Stack feature support work (to be officially released in <a href="https://istio.io/latest/news/releases/1.17.x/announcing-1.17/#istio-dual-stack-support">Istio 1.17</a>).</p></div></div></div></div></div></div></section></main></div><footer class="footer is-dark"><div class="container container-medium"><div class="footer-inner"><div class="columns"><div class="column"><div class="footer-content"><div class="columns is-mobile"><div class="column"><h6 class="footer-title">About</h6><ul class="footer-list nobullet"><li class="item-no-bullet"><a href="/learn/">Learn</a></li><li class="item-no-bullet"><a href="/software/">Software</a></li><li class="item-no-bullet"><a href="/community/">Community</a></li><li class="item-no-bullet"><a href="/supporters/">Supporters</a></li></ul></div><div class="column"><h6 class="footer-title">Connect</h6><ul class="footer-list nobullet"><li class="item-no-bullet"><a href="http://lists.katacontainers.io/cgi-bin/mailman/listinfo">Mailing Lists</a></li><li class="item-no-bullet"><a href="https://bsky.app/profile/katacontainers.io">Bluesky</a></li><li class="item-no-bullet"><a href="https://twitter.com/KataContainers">Twitter</a></li><li class="item-no-bullet"><a href="http://webchat.oftc.net/?channels=kata-dev">IRC: #kata-dev</a></li><li class="item-no-bullet"><a href="http://webchat.oftc.net/?channels=kata-general">IRC: #kata-general</a></li></ul></div><div class="column"><h6 class="footer-title">Resources</h6><ul class="footer-list nobullet"><li class="item-no-bullet"><a href="https://github.com/kata-containers">Code</a></li><li class="item-no-bullet"><a href="https://github.com/kata-containers/kata-containers/releases/">Releases</a></li><li class="item-no-bullet"><a href="/docs/">Documentation</a></li><li class="item-no-bullet"><a href="https://github.com/kata-containers/community?tab=readme-ov-file#vulnerability-handling">Security vulnerabilities</a></li></ul></div></div></div></div><div class="column"><div class="footer-aside"><div class="footer-entry"><p>Kata Containers is an independent open source community collaboratively developing code under the Apache 2 license. The project is supported by the Open Infrastructure Foundation; the community follows the OpenInfra Foundation <a href="//openinfra.dev/legal/code-of-conduct/">Code of Conduct</a>.</p></div><div class="footer-brand"><a href="/" class="router-link-exact-active router-link-active"><img src="data:image/svg+xml;base64,PHN2ZyBpZD0iTGF5ZXJfMSIgZGF0YS1uYW1lPSJMYXllciAxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA5NC4wMyAxNTguNjEiPjxkZWZzPjxzdHlsZT4uY2xzLTF7ZmlsbDojZjE1YjNlO30uY2xzLTJ7ZmlsbDojMmEzOTRkO308L3N0eWxlPjwvZGVmcz48dGl0bGU+S2F0YUNvbnRhaW5lcnNfTG9nb19TdGFja2VkXzJDb2xvcl9SR0I8L3RpdGxlPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTExNC42LDgyLjUxbC0zNSwzNS0zNS0zNSw2LjItNi4yTDc5LjYxLDEwNS4xbDI4Ljc4LTI4Ljc5Wk05Niw4MmwtOS4xLTkuMSw5LjA1LTkuMDUsOS4xLDkuMVpNODIsNzQuODEsOTIuNTYsODUuMzYsODIsOTUuOTFabS00LjgsMjEuMS0yMy0yMywyMy0yM1ptNC44LTQ2LDEwLjUsMTAuNUw4Miw3MC45M1pNNDQuNjMsNjMuMzNsMzUtMzUsMzUsMzUtNi4yMSw2LjJMNzkuNjEsNDAuNzUsNTAuODMsNjkuNTNabTc2Ljc1LDBMNzkuNjEsMjEuNTYsMzcuODQsNjMuMzNsOS42LDkuNTktOS42LDkuNTksNDEuNzcsNDEuNzcsNDEuNzctNDEuNzctOS42LTkuNTlaIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgtMzIuNiAtMjEuNTYpIi8+PHBvbHlnb24gY2xhc3M9ImNscy0xIiBwb2ludHM9IjEzLjk4IDExNS45MyA1LjA5IDEyNC40MyA1LjA5IDEwMy4yIDAgMTAzLjIgMCAxNDAuNzMgNS4wOSAxNDAuNzMgNS4wOSAxMzEuMDYgNi44OSAxMjkuMzIgMTQuNjYgMTQwLjczIDIwLjQ4IDE0MC43MyAxMC40NyAxMjUuODkgMjAuODEgMTE1LjkzIDEzLjk4IDExNS45MyIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTc0LjksMTM5LjUxYTEwLjU5LDEwLjU5LDAsMCwwLTcuMjctMi44MSwxMS45LDExLjksMCwwLDAtNi4zMywxLjcsMTEuNTksMTEuNTksMCwwLDAtNC4zOCw0LjcxLDE0LjM1LDE0LjM1LDAsMCwwLTEuNTYsNi43NEExNC41NSwxNC41NSwwLDAsMCw1NywxNTYuNjZhMTEuODQsMTEuODQsMCwwLDAsMTAuNzcsNi40MiwxMC40NywxMC40NywwLDAsMCw1LTEuMjEsMTEuNSwxMS41LDAsMCwwLDIuMjMtMS41N3YySDgwdi0yNC44SDc0LjlabS0xLDE0Ljc5YTcuMDksNy4wOSwwLDAsMS0yLjU2LDIuOTUsNi43MSw2LjcxLDAsMCwxLTMuNzUsMS4wNUE2LjYsNi42LDAsMCwxLDY0LDE1Ny4yNWE3LDcsMCwwLDEtMi41NC0zLDkuODMsOS44MywwLDAsMS0xLTQuNDQsOS41Miw5LjUyLDAsMCwxLDEtNC4zOEE3LjE3LDcuMTcsMCwwLDEsNjQsMTQyLjUzYTYuNjgsNi42OCwwLDAsMSwzLjY4LTEsNi44LDYuOCwwLDAsMSwzLjc1LDEsNy4xMiw3LjEyLDAsMCwxLDIuNTYsMywxMC41OSwxMC41OSwwLDAsMSwwLDguODFaIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgtMzIuNiAtMjEuNTYpIi8+PHBvbHlnb24gY2xhc3M9ImNscy0xIiBwb2ludHM9IjYwLjg5IDEwOC4yOCA1NS44MSAxMDguMjggNTUuODEgMTE1LjkzIDUxLjg3IDExNS45MyA1MS44NyAxMjAuNzIgNTUuODEgMTIwLjcyIDU1LjgxIDE0MC43MyA2MC44OSAxNDAuNzMgNjAuODkgMTIwLjcyIDY2LjIyIDEyMC43MiA2Ni4yMiAxMTUuOTMgNjAuODkgMTE1LjkzIDYwLjg5IDEwOC4yOCIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTEyMS41NCwxMzcuNDl2MmExMC42LDEwLjYsMCwwLDAtMi4yNC0xLjU5LDEwLjQ1LDEwLjQ1LDAsMCwwLTUtMS4yMiwxMS45LDExLjksMCwwLDAtNi4zMywxLjcsMTEuNTksMTEuNTksMCwwLDAtNC4zOCw0LjcxLDE0LjM1LDE0LjM1LDAsMCwwLTEuNTYsNi43NCwxNC40OSwxNC40OSwwLDAsMCwxLjYsNi44MSwxMS44MSwxMS44MSwwLDAsMCwxMC43Niw2LjQyLDEwLjQ3LDEwLjQ3LDAsMCwwLDUtMS4yMSwxMS41LDExLjUsMCwwLDAsMi4yMy0xLjU3djJoNS4wOXYtMjQuOFptLTEsMTYuODFhNy4wOSw3LjA5LDAsMCwxLTIuNTYsMi45NSw2LjcxLDYuNzEsMCwwLDEtMy43NSwxLjA1LDYuNiw2LjYsMCwwLDEtMy42OC0xLjA1LDcsNywwLDAsMS0yLjU0LTMsOS44Myw5LjgzLDAsMCwxLTEtNC40NCw5LjUyLDkuNTIsMCwwLDEsMS00LjM4LDcuMTcsNy4xNywwLDAsMSwyLjU0LTIuOTQsNi43LDYuNywwLDAsMSwzLjY4LTEsNi43OCw2Ljc4LDAsMCwxLDMuNzUsMSw3LjIxLDcuMjEsMCwwLDEsMi41NywzLDEwLjY0LDEwLjY0LDAsMCwxLDAsOC44MVoiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0zMi42IC0yMS41NikiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik0zNSwxNzkuNTdhNC4yNyw0LjI3LDAsMCwxLTEuNTctMS42OSw1LjE0LDUuMTQsMCwwLDEtLjU3LTIuNDQsNS4yOSw1LjI5LDAsMCwxLC41Ni0yLjQ1QTQuMTUsNC4xNSwwLDAsMSwzNSwxNzEuMzFhNC4zNyw0LjM3LDAsMCwxLDIuMjgtLjYxLDMuNzIsMy43MiwwLDAsMSwxLjg4LjQ3LDUuMTUsNS4xNSwwLDAsMSwxLjQ3LDEuMzFsLTEsLjc0YTIuODIsMi44MiwwLDAsMC0yLjQtMS4zNCwyLjksMi45LDAsMCwwLTEuNi40NSwzLjA1LDMuMDUsMCwwLDAtMS4xMSwxLjI3LDQuNDMsNC40MywwLDAsMCwwLDMuNjgsMy4wNSwzLjA1LDAsMCwwLDEuMTEsMS4yNywyLjksMi45LDAsMCwwLDEuNi40NSwzLDMsMCwwLDAsMS40OS0uMzIsMy4xMywzLjEzLDAsMCwwLDEuMDYtLjkxbDEsLjdhNC41Niw0LjU2LDAsMCwxLTEuNTQsMS4yNCw0LjMsNC4zLDAsMCwxLTIsLjQ2LDQuMzcsNC4zNywwLDAsMS0yLjI5LS42IiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgtMzIuNiAtMjEuNTYpIi8+PHBhdGggY2xhc3M9ImNscy0yIiBkPSJNNDksMTc4LjU1YTMuMTIsMy4xMiwwLDAsMCwxLjExLTEuMjcsNC40Myw0LjQzLDAsMCwwLDAtMy42OEEzLjEyLDMuMTIsMCwwLDAsNDksMTcyLjMzYTMsMywwLDAsMC0xLjYyLS40NSwyLjg5LDIuODksMCwwLDAtMS41OS40NSwzLjIxLDMuMjEsMCwwLDAtMS4xLDEuMjYsNCw0LDAsMCwwLS40LDEuODMsNC4xNiw0LjE2LDAsMCwwLC40LDEuODYsMy4xNywzLjE3LDAsMCwwLDEuMSwxLjI3LDIuODksMi44OSwwLDAsMCwxLjU5LjQ1LDMsMywwLDAsMCwxLjYyLS40NW0tMy44NSwxYTQuMjMsNC4yMywwLDAsMS0xLjU3LTEuNyw1LjUxLDUuNTEsMCwwLDEsMC00Ljg4LDQuMDksNC4wOSwwLDAsMSwxLjU2LTEuNjgsNC4yNyw0LjI3LDAsMCwxLDIuMjYtLjYxLDQuMzYsNC4zNiwwLDAsMSwyLjI3LjYxQTQuMTcsNC4xNywwLDAsMSw1MS4xOSwxNzNhNS4xOCw1LjE4LDAsMCwxLC41OCwyLjQ1LDUuMjUsNS4yNSwwLDAsMS0uNTYsMi40NCw0LjE3LDQuMTcsMCwwLDEtMS41NiwxLjY5LDQuMjcsNC4yNywwLDAsMS0yLjI2LjYsNC4zNSw0LjM1LDAsMCwxLTIuMjctLjYiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0zMi42IC0yMS41NikiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik02MC41NiwxNzEuMDhhMi45NCwyLjk0LDAsMCwxLDEuMjUsMS4xMiwzLjE4LDMuMTgsMCwwLDEsLjQ2LDEuNzR2NS45M0g2MXYtNS4zNmMwLTEuNzYtLjc5LTIuNjMtMi4zNS0yLjYzYTIuMzYsMi4zNiwwLDAsMC0yLDEsNC40Nyw0LjQ3LDAsMCwwLS42OCwyLjZ2NC40M0g1NC42MlYxNzFoMS4yOXYxLjQ3YTMuMzgsMy4zOCwwLDAsMSwxLjItMS4zMSwzLjIzLDMuMjMsMCwwLDEsMS43My0uNDcsMy45NCwzLjk0LDAsMCwxLDEuNzIuMzgiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0zMi42IC0yMS41NikiLz48cG9seWdvbiBjbGFzcz0iY2xzLTIiIHBvaW50cz0iMzMuNzEgMTU4LjMxIDMzLjcxIDE1MC42MiAzMi4yIDE1MC42MiAzMi4yIDE0OS40NSAzMy43MSAxNDkuNDUgMzMuNzEgMTQ2LjUxIDM1IDE0Ni41MSAzNSAxNDkuNDUgMzcuMDUgMTQ5LjQ1IDM3LjA1IDE1MC42MiAzNSAxNTAuNjIgMzUgMTU4LjMxIDMzLjcxIDE1OC4zMSIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTc3LjUzLDE3OC41NWEzLjIsMy4yLDAsMCwwLDEuMTEtMS4yNyw0LjQzLDQuNDMsMCwwLDAsMC0zLjY4LDMuMiwzLjIsMCwwLDAtMS4xMS0xLjI3LDMsMywwLDAsMC0xLjYyLS40NSwyLjg5LDIuODksMCwwLDAtMS41OS40NSwzLjE0LDMuMTQsMCwwLDAtMS4xLDEuMjYsNCw0LDAsMCwwLS40LDEuODMsNC4xNiw0LjE2LDAsMCwwLC40LDEuODYsMy4xLDMuMSwwLDAsMCwxLjEsMS4yNywyLjg5LDIuODksMCwwLDAsMS41OS40NSwzLDMsMCwwLDAsMS42Mi0uNDVtMi44LTcuNTR2OC44Nkg3OXYtMS4zYTQuMTIsNC4xMiwwLDAsMS0xLjM1LDEuMTgsMy42NywzLjY3LDAsMCwxLTEuNzQuNDIsNC4zNSw0LjM1LDAsMCwxLTIuMjctLjYsNC4yLDQuMiwwLDAsMS0xLjU3LTEuNjksNS41Myw1LjUzLDAsMCwxLDAtNC44OSw0LjA5LDQuMDksMCwwLDEsMS41Ni0xLjY4LDQuMjcsNC4yNywwLDAsMSwyLjI2LS42MSwzLjY1LDMuNjUsMCwwLDEsMS43Ny40Myw0LDQsMCwwLDEsMS4zNiwxLjJWMTcxWiIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTMyLjYgLTIxLjU2KSIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTg0LjQ1LDE3MWgxLjI4djguODZIODQuNDVabS0uMDktMmExLDEsMCwwLDEtLjI5LS43NCwxLDEsMCwwLDEsLjI5LS43MSwxLjA1LDEuMDUsMCwwLDEsMS40NSwwLDEsMSwwLDAsMSwwLDEuNDUsMSwxLDAsMCwxLTEuNDUsMCIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTMyLjYgLTIxLjU2KSIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTk1LjgsMTcxLjA4YTIuODgsMi44OCwwLDAsMSwxLjI1LDEuMTIsMy4xOCwzLjE4LDAsMCwxLC40NiwxLjc0djUuOTNIOTYuMjN2LTUuMzZjMC0xLjc2LS43OS0yLjYzLTIuMzUtMi42M2EyLjMzLDIuMzMsMCwwLDAtMiwxLDQuNCw0LjQsMCwwLDAtLjY5LDIuNnY0LjQzSDg5Ljg2VjE3MWgxLjI5djEuNDdhMy41NCwzLjU0LDAsMCwxLDEuMi0xLjMxLDMuMjMsMy4yMywwLDAsMSwxLjczLS40NywzLjkxLDMuOTEsMCwwLDEsMS43Mi4zOCIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTMyLjYgLTIxLjU2KSIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTEwNy44NCwxNzQuNjRhMy4zOSwzLjM5LDAsMCwwLS45My0yLjA3LDIuODEsMi44MSwwLDAsMC0yLS42OSwyLjczLDIuNzMsMCwwLDAtMiwuNzgsMy42MSwzLjYxLDAsMCwwLTEsMlptLS43OC0zLjM1YTQuMTgsNC4xOCwwLDAsMSwxLjUyLDEuNiw0LjY0LDQuNjQsMCwwLDEsLjU1LDIuMjZjMCwuMjQsMCwuNDMsMCwuNTZoLTcuMjlhMy43NSwzLjc1LDAsMCwwLC44OSwyLjMzLDIuNzQsMi43NCwwLDAsMCwyLjIxLDEsMy43MiwzLjcyLDAsMCwwLDEuODktLjQzLDMuMjMsMy4yMywwLDAsMCwxLjItMS4xOGwxLC42OGE0LjQ3LDQuNDcsMCwwLDEtMS42NSwxLjU1LDUsNSwwLDAsMS0yLjQyLjU1LDQuMzcsNC4zNywwLDAsMS0yLjI5LS42LDQuMjcsNC4yNywwLDAsMS0xLjU3LTEuNjksNS4xNCw1LjE0LDAsMCwxLS41Ny0yLjQ0LDUuMjksNS4yOSwwLDAsMSwuNTUtMi40NSw0LjIyLDQuMjIsMCwwLDEsMS41Ni0xLjY4LDQuMzMsNC4zMywwLDAsMSwyLjI3LS42MSw0LjA2LDQuMDYsMCwwLDEsMi4xNS41OSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTMyLjYgLTIxLjU2KSIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTExNy4yOSwxNzAuODRWMTcyYTIsMiwwLDAsMC0uODctLjE5LDIuNjgsMi42OCwwLDAsMC0xLjUxLjQ2LDMuMTEsMy4xMSwwLDAsMC0xLjEzLDEuMzEsNC40OCw0LjQ4LDAsMCwwLS40MywydjQuMjRoLTEuMjlWMTcxaDEuMjl2MS43OGE0LjIzLDQuMjMsMCwwLDEsMS4zLTEuNTQsMywzLDAsMCwxLDEuNzctLjU1LDIuNzQsMi43NCwwLDAsMSwuODcuMTQiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0zMi42IC0yMS41NikiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik0xMjAuMzksMTc5LjYyYTMuNiwzLjYsMCwwLDEtMS40OS0xLjU1bDEuMTYtLjU3YTIuNzMsMi43MywwLDAsMCwyLjc0LDEuNSwzLjMxLDMuMzEsMCwwLDAsMS42My0uMzYsMS4yLDEuMiwwLDAsMCwuNjUtMS4xMiwxLjMyLDEuMzIsMCwwLDAtLjUzLTEuMTUsMy42MywzLjYzLDAsMCwwLTEuODItLjQ5LDQuNjgsNC42OCwwLDAsMS0yLjYtLjgyLDIuMTcsMi4xNywwLDAsMS0uNzktMS43NiwyLjI3LDIuMjcsMCwwLDEsLjg5LTEuOTEsMy44OSwzLjg5LDAsMCwxLDIuNDQtLjY5LDMuNTcsMy41NywwLDAsMSwzLjU4LDIuMDlsLTEuMTYuNTZhMi4yMSwyLjIxLDAsMCwwLS45NC0xLjExLDMsMywwLDAsMC0xLjU3LS4zNiwyLjY1LDIuNjUsMCwwLDAtMS41MS4zNiwxLjE2LDEuMTYsMCwwLDAtLjUyLDEsMS4xOCwxLjE4LDAsMCwwLC41NiwxLDQuMTcsNC4xNywwLDAsMCwxLjkyLjQ5LDQuNjcsNC42NywwLDAsMSwyLjUxLjgzLDIuMTcsMi4xNywwLDAsMSwuODIsMS43NywyLjMyLDIuMzIsMCwwLDEtLjUxLDEuNTMsMy4wNywzLjA3LDAsMCwxLTEuMzYuOTUsNS4yNyw1LjI3LDAsMCwxLTEuODQuMzIsNC41LDQuNSwwLDAsMS0yLjI2LS41NSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTMyLjYgLTIxLjU2KSIvPjwvc3ZnPg==" alt="Kata Containers"/></a></div></div></div></div></div></div></footer></div></div><div id="gatsby-announcer" style="position:absolute;top:0;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0, 0, 0, 0);white-space:nowrap;border:0" aria-live="assertive" aria-atomic="true"></div></div><script async="" src="https://www.googletagmanager.com/gtag/js?id=UA-110599884-1"></script><script> function gaOptout(){document.cookie=disableStr+'=true; expires=Thu, 31 Dec 2099 23:59:59 UTC;path=/',window[disableStr]=!0}var gaProperty='UA-110599884-1',disableStr='ga-disable-'+gaProperty;document.cookie.indexOf(disableStr+'=true')>-1&&(window[disableStr]=!0); if(!(navigator.doNotTrack == "1" || window.doNotTrack == "1")) { window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-110599884-1', {"anonymize_ip":true,"cookie_expires":0,"send_page_view":false}); } </script><script id="gatsby-script-loader">/*<![CDATA[*/window.pagePath="/blog/inject-workloads-with-kata-containers-in-istio/";/*]]>*/</script> <script id="gatsby-chunk-mapping" > window.___chunkMapping="{\"app\":[\"/app-57e4360fa52ac58608f4.js\"],\"component---cache-caches-gatsby-plugin-offline-app-shell-js\":[\"/component---cache-caches-gatsby-plugin-offline-app-shell-js-4322c758d53f068b5674.js\"],\"component---src-pages-404-js\":[\"/component---src-pages-404-js-3c38529474745aa813a8.js\"],\"component---src-pages-blog-index-js\":[],\"component---src-templates-blog-post-js\":[\"/component---src-templates-blog-post-js-17eaaf8dbc6eba25fdf5.js\"],\"component---src-templates-community-page-js\":[\"/component---src-templates-community-page-js-4ab8a9069963b24c2c02.js\"],\"component---src-templates-docs-page-js\":[\"/component---src-templates-docs-page-js-b820d5e3421f3e4c34ab.js\"],\"component---src-templates-index-page-js\":[\"/component---src-templates-index-page-js-d80840a80cf43e4e6677.js\"],\"component---src-templates-learn-page-js\":[\"/component---src-templates-learn-page-js-197a98d7957c7a9aaf7c.js\"],\"component---src-templates-software-page-js\":[\"/component---src-templates-software-page-js-51787ca6580c9ddd274d.js\"],\"component---src-templates-supporters-page-js\":[\"/component---src-templates-supporters-page-js-d59a18077ba1bfc3dda2.js\"],\"component---src-templates-tags-js\":[\"/component---src-templates-tags-js-8beeb97ed0a0b3a32f02.js\"],\"component---src-templates-use-cases-page-js\":[\"/component---src-templates-use-cases-page-js-5a117e4973f7ba2fedd6.js\"]}"; </script> <script>window.___webpackCompilationHash="465bff3dc0ec654c6048";</script><script src="/webpack-runtime-878a6f4a408ca821ec37.js" async></script><script src="/framework-8fa49394cab2716fedab.js" async></script><script src="/app-57e4360fa52ac58608f4.js" async></script></body></html>