# Kata Containers

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/

Repository: https://github.com/kata-containers/kata-containers
Canonical: https://ross.abutalabs.com/products/kata-containers
Language: Rust
License: Apache-2.0
License Family: permissive
Topics: kvm, virtualization, containers, kubernetes, k8s, virtual-machine, qemu, firecracker, oci, cri-o, cri, security, docker
Last push: 2026-08-26T21:52:07+00:00
Link (homepage): https://katacontainers.io/

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 3191, "days_push": 7, "days_rel": 12, "gap_med": 28, "n_releases_24m": 28}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8606, forks 1448 (observed 2026-08-28T04:10:23.765277+00:00)

## What it is
Kata Containers is an open source container runtime that builds lightweight virtual machines which plug seamlessly into the container ecosystem, offering container-like performance with VM-grade hardware isolation. It supports multiple hypervisors (QEMU, Cloud-Hypervisor, Firecracker) and integrates with Docker, containerd, CRI-O, and Kubernetes via OCI and CRI standards.

## Use cases
- run untrusted workloads in Kubernetes with stronger isolation
- sandbox multi-tenant containers on a shared cluster
- get VM-level kernel isolation without sacrificing container performance
- secure CI/CD build jobs with hardware-enforced isolation
- replace nested containers inside full VMs with lightweight VMs
- isolate network, memory, and I/O per container workload

## When to choose
- you need stronger workload isolation than shared-kernel containers provide
- you run multi-tenant Kubernetes clusters and want sandboxed pods
- you want OCI/CRI compatibility so existing container tooling keeps working
- you need hardware-enforced isolation using VT-x, ARM Hyp, or confidential computing extensions

## When to avoid
- your host lacks hardware virtualization support (no KVM)
- you need maximum container density and startup speed with minimal overhead
- you only run trusted first-party workloads where shared-kernel isolation suffices
- you target non-Linux hosts, since Kata requires a Linux host with a hypervisor

## Facets
- artifact type: application
- maturity: stable
- function: container-runtime, security, container-orchestration
- domain: security, cloud-computing
- platform: cloud, self-hosted
- tags: lightweight-vms, oci-runtime, qemu, firecracker, cloud-hypervisor, hardware-virtualization, workload-isolation, cri, sandboxed-containers, virtualization, containers, devops, linux, docker, kubernetes

## Member repositories
- kata-containers/kata-containers (main) score 99
- kata-containers/runtime (mirror) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:23.765277+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:26:07.634970+00:00, confidence not recorded.
  - readme: https://github.com/kata-containers/kata-containers (fetched 2026-08-28T04:10:23.765277+00:00, sha dedd5fa13001)
  - homepage: https://katacontainers.io/ (fetched 2026-08-29T08:26:19.817133+00:00, sha a207642af588)
- Data as of 2026-08-30T08:39:29.467469+00:00.