The safeguards map / 3.1 Execution sandboxes
Kata Containers
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A container runtime that runs each workload in a lightweight virtual machine to give stronger isolation than a shared-kernel container.
Where it sits
3.1 Execution sandboxes (primary): Runs container workloads inside lightweight virtual machines, so hardware virtualization adds a second layer of isolation between a workload and the host.
stronger workload isolation using hardware virtualization technology as a second layer of defense
captured
Secure, lightweight CRI compatible virtualized containers.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- vendor defaults
- Can the agent bypass it
- depends
Handoffs
None recorded. A mapped entry with no handoff is here for its foundation home.
Collector's note
OpenInfra's projects page lists Kata Containers under "Confirmed projects", a stage the maturity vocabulary has no value for, so the stage is the plain release. The in-guest kata-agent and any owner-written policy for it were not read, so the entry is the isolation boundary alone.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.