►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Kata and gVisor: A Quantitative Comparison - Xu Wang, hyper.sh
In the past year, hyper.sh+intel released Kata Containers, and Google released gVisor. The two projects shared many features: - both aim to work with kubernetes CRI seamlessly; - both could be treated as secure container runtimes; - both introduce some hypervisor technologies to improving isolation. On the other hand, the two projects have many differences. Kata Containers is a more general solution and could work with existing accelerating technologies, while gVisor provide better flexibility, which means the user could scale up/down a running container easily. In this session, the speakers will introduce both projects in detail, and make the quantitive comparison between them -- how much footprint/performance costs are introduced by the different methods of isolation; which perform better in standard benchmarks and lifetime workload, etc.
To learn more: https://sched.co/GrZK
A
Thank
you,
I
went
to
at
hand
this
a
pretty
late
session
and
I
know.
I
know
some
some
friends,
however,
already
on
their
way
home,
and
so
this
this
says
this
condom.
I,
slides
I
have
poisoned
it
in
about
one
month
ago,
I
bought
in,
but
this
time
I
updated
them
with
new
daters
and
some
some
new
interesting
things,
and
this
the
current
is,
is
some
background
about
the
kaha
containers
and
maybe
divisor
I'd
like
to
ask
all
the
audience.
A
A
So
I
will
have
the
three
parts
and
the
first
days
to
just
a
brief
introduction
about
the
color
containers
and
divisors
and
then
the
comparator
architecture
and
then
to
the
the
main
parties
about
the
benchmarks
and
I
know
you.
You
will
have
mining
challenges
to
me
for
the
for
the
for
the
benchmarks
and
since
I
think
it.
Since
all
of
you
have
some
background
about
the
color
containers
project,
so
I
may
I
may
have
the
first
first
apart,
go
through
quickly.
A
A
Yes
about
Harlequin
dinners,
yeah,
it's
a
can
in
Iran
ham,
just
lacrima
see
you
can
cut
through
the
Kennedy
through
suits
come
online,
just
like
Rossi,
yes
from
talker
and
something
else,
but
the
difference
is
that
virtualization,
based
so
from
the
how
society?
It's
like
a
VM,
hey
I,
think
you
have
go
on
your
way
home
and
about
your
visor
yeah.
A
That's
like
receipt
foo,
and
also
it's
a
another
thing
for
isolation,
and
it's
a
user
base
kernel
actually
and
that
develop
put
in
Google
for
four
years
and
open
source
in
about
six
months
ago,
just
in
the
private
Kubek
on
in
Copenhagen
and
yeah,
it's
implements
Linux
Linux
of
Pi
in
Linux
yeah
and
both
are
very
similar.
They
they
run
on
top
of
Linux
on
top
of
Linux
api's
and
also
provide
Linux
api's
to
the
to
the
container.
A
A
It
will
write
in
different
processes,
but
when
you're
a
binary
looks
pretty
easy
for
use
and
also
the
they
have
a
century
as
a
user
space
kernel
here
yeah-
and
there
is
another
process
for
the
file
file
system
and
yeah
I
think
you're
all
noticed
a
bit
and
four
color
containers
and
if
you
have
installed
1/4
of
the
catechin
dinners,
it's
a
bit
complicated.
But
actually
you
just
called
the
cutter
and
ham
and
I
were
other
things
called
color
and
ham
here
and
other
things
are
created
automatically.
A
A
About
the
architecture,
and
here
the
container
container
applications
will
run
in
the
in
the
VM
based
asset
box
and
yeah.
We
can
have
some,
we
host
users
for
the
for
the
first
user
space
io
and
we
host
in
the
in
the
kernel,
kernel,
pod
and
the
pass-through
and
all
kinds
of
the
I
all
support
us.
We
am
supported
and
for
the
isolation,
part
s2
layer
of
isolation.
The
first,
of
course,
is
the
the
battle
Padma
is
about
the
host
and
the
guest.
A
It
is
protected
by
the
by
the
hypervisor,
and
the
second
is
the
dream:
protection
between
the
Casa
kernel
and
and
the
container
applications.
So
the
true
level
of
isolation.
And
yes,
we
have.
We
have
Q
mu,
2,
mu,
light
default
by
default.
It's
the
PMM
here
and
also
we
are
working
on.
You
never
knew
me
a
much
simpler,
much
simpler
way.
The
hypervisor.
Also
we
just
do
some
research
and
we
have.
A
A
A
As
far
as
I
know
the
device
or
team,
but
the
idea
is
the
most-
the
most
frequent
Cobb
has
of
the
of
the
Cisco's
are
quite
stable
and
secure.
But
the
the
last
card
maybe
have
some
some
packs
there
that
most
most
of
the
exploits
that
goes
through
tap.
The
the
last
card
freak
less
frequently
called
Cisco's,
so
a
while
call
them
through
the
here
and
some
some
some
real
Cisco's
realized
to
the
hosta
to
employment
and
others.
A
They
could
employment
that
could
they
could
do
the
interception
and
therefore
the
Cisco's
bike
to
the
to
the
century.
The
user
space
kernel
and
implement
them
so
have
either
as
have
better
security
than
only
run
the
the
namespaces
and
based
on
their
their
research.
They
think
the
most
most
of
the
a
major
part
of
the
compromise
has
come
from
the
file
file
system
and
the
open
open
operation.
A
A
First
first
thing
in
in
their
consideration,
but
security,
and
one
more
thing
is
about
the
G
riser
platforms
that
you
riser
the
open
source
version
of
devisor
countries
about
tools,
support
to
perform
that
in
the
cisco,
even
in
reception
part,
they
use
either
petrus
older,
older,
older
k,
vm-
and
here
here
I
want
to
say
the
king
emma
is
just
a
tool.
They
they
used
to
intercept
the
the
syscalls.
It's
not
it's,
not
for
vm
v,
I'm
liable
isolation.
A
So
that's
not
isolation,
part,
but
only
for
the
for
the
for
the
for
the
cisco
interception
and
the
other
part.
They
are
the
same
with
the
petrous
part,
except
use.
The
given
part
that
will
be
a
bit
faster
in
impaired
mental
case
and
later
I
will
I
will
have
the
comparison
in
the
with
some
data
and
from
the
architecture
we
can.
We
can
think
post
to
post
both
of
the
tool
and
ham
include
the
two
level
of
isolation
and
there
will
be
better
have
better
isolation
than
mercy.
A
Yes
and
I
mean
biter
and
not
that's,
not
absolutely
secure
yeah
for
the
secure
things
you
can
have
something
battery
architecture,
but
not
for
the
single
CV
is
yes
and
the
full
compatibility
and
cutter
should
should
be
better,
because
the
divisor
is
is
another
another
one
have
another
use
of
space
kernel,
but
for
for
kata
we
users
means
kernel
inside
and
for
the
performance
side.
Both
should
have
a
very
little
overhead
in
CPU
and
memory,
especially
for
the
CPU
power.
A
A
So
yeah
cool-
I
just
have
me
10
minutes
to
to
pass
to
pass
all
the
general
general
pass
and
later
I
will
go
through
some.
Some
dangers
share
the
details
with
you.
I
know
you
must
have
questions
about
this
this
part
and
about
the
benchmark.
That's
functional
parts
is
about
the
cisco,
cisco
coverage
and
some
other
things
and
the
standard
benchmark
include
boot
time
and
memory,
footprint,
cpu
and
memory
performance
and
I/o
performance
and
networking
performance.
A
Engines
radius
and
has
a
flaw.
We
also
tried
some
some
other
thing,
other
other
some
other
cases,
but
for
the
compatibility
issues
and
some
some
some
case
is
not
not
suitable
for
the
comparison,
such
as
the
bicycle
and
Jenkins
Oh
failed
and
looks
like
I,
don't
know
what
what
they
they
down
in
the
kid
cologne,
but
they're,
really
failed
yeah,
and
that
has
set
up
here
is
about
the
paramedic
deployment.
A
We
used
instance
from
the
packet
on
that,
and
so
we
pay
for
this,
and
they
didn't
donate
for
this
for
this
test,
and
for
this
we
use
some
more
powerful
server.
That's
have
to
have
more
discs
for
the
for
the
test
and
for
more
cases,
and
also
actually
we
have
some.
We
have
some
virtual
machine
instance
from
the
Google
cloud
to
do
more
has
for
the
for
the
NASA
depart,
and
most
of
that
has
containers
have
eight
gigabytes
memory,
if
not
no
photos
Paris.
A
Yes,
for
the
Cisco
coverage
we
tested
with
different
cases
and
for
divisor
we
treated
a
code
and
because
the
code
is
quite
costs
more,
so
it's
pretty
easy
to
find.
They
only
call
about
776
calls
and
the
foot
for
cotton.
It's
pretty
hard
if
we
try
to
grab
the
the
Cisco's
from
the
queue
from
cumulus
something.
So
we
just
do
this
trace
for
four
different
cases.
I'd
be
different,
so
they
called
about
from
30
to
50.
A
This
is
caused
in
different
cases
and
actually
both
both
are
different
cases,
restrict
the
access
from
the
castle
to
the
hosta,
to
a
small
side
of
the
of
the
Cisco's,
and
most
of
the
Cisco's
will
be
precise
it
by
the
gastric
kernel,
either
in
the
mo
or
in
the
user
space
kernel,
and
so
for
the
photo
memory
memory
footprint
tester.
We
use
a
relative
small
small
size
of
the
container
and
to
test
the
mr.
mr.
mr.
memory
and
for
there's
two
two
case
here.
A
The
first
of
the
blue,
one
woman
is
just
a
single
container.
Then
we
can
see
the
it's
about
about
three
times
of
the
memory
footprint.
Compare
the
containers
with
the
divisor,
but
we
introduced
some
some
packet
technology
called
the
template,
the
after
enable
template
and
if
we
launch
25
containers
and
and
calculate
memory
footprint,
and
then
it
will
will
be
closer.
Yes,
I
can
see
if
we
run,
and
so
then
there
will
be
much
closer
and.
A
Yeah,
so
the
template
itself
is
try
to
do
the
copy
all
right
on
the
on
the
same
part
of
the
map,
also
I'm
a
I'm,
a
enabled
TSM.
So
if
we
enable
the
chasm
for
the
water
machines
now
we'll
save
much
memories
but
watch
what
I
chose
I
like
to
save
fertilizer
and
you
can
save
the
memory
out
of
box
and
so
so
for
memory,
footprint,
I
think
the.
A
In
this
morning,
there
is
a
session
about
the
about
security,
I
think
or
maybe
maybe
this
one
they
talk
about
for
the
for
the
cut
aparts
said
about
some
series
of
that
the
cumulative
lies,
the
the
car
is
not
safe,
but
actually
what?
What
most
of
this?
The
series
from
the
the
queue
is
from
the
the
last
card
part
and
from
the
from
from
what
we
use?
We
also
we
always
come
as
we.
A
What
we
always
can
figure
out
in
that
the
buggy
part,
that's
just
all
most
of
the
the
almost
always
true
for
the
for
the
either
the
kernel
or
the
VMS
or
others.
The
the
main
major
part
of
the
backs
are
always
live
in
the
the
last
frequently
called
parts
such
as
some
some
legacy
devices
such
as
floppies
and
maybe
some
carve
some
plaster
card.
A
Maybe
I
think
that
twenty
years
old
devices
and
some
serious
VGA
adapters
I
never
see
a
real
seriously
dat
adapters.
But
I
saw
that
in
the
water
immersion
many
times,
but
for
for
kana
we
never
using
such
devices,
and
we
can't
we
just
can't
figure
them
out
and
later
when
we,
when
we
change
to
new
mill
and
there's
a
further
less
of
the
of
the
devices
and
the
for
the
for
the
firecracker
in
the.
In
the
same
way,
they
have
no
computer
models.
So
there
will
be
much
lighter.
Much
lighter
facts
about
this
tricky
part.
A
A
A
Right
yeah
for
the
left
for
the
left
of
figure.
It's
about
the
bare
metal
by
my
toe
test
for
para
mental.
We
can
see
the
the
pastor
case
for
the
for
the
character.
The
nurse
that's
pretty
similar
to
the
to
the
dressy,
but
the
riser
is
even
better
yeah
and
the
worst
of
things
is
to
just
call
the
command
line
and
without
mine
any
feature
enabled,
but
for
11.5
we
have
Molly.
A
A
We
can
see
some
performance
penalty
for
the
for
the
9c,
the
virtualization,
as
some
for
some
for
some
page
table
things,
but
for
the
for
the
divisors.
If
you
search
you
guys
are
petrus
platform
and
there
is
no
nicely
the
water
ization
here,
so
there's
no
different
than
the
memory
memory,
its
performance
apart,
but
that
doesn't
mean
the
divisor
will
have
better
performance
in
the
IRA
area.
A
But
if
you
talk
about
only
about
the
memory
performance,
the
divisors
in
in
the
nest
hitter
case
looks
pretty
good
and
do
I/o
performance
when
we
do
the
I/o
performance
yeah.
Firstly,
we
used
I
altered
to
the
I/o
performance,
but
unfortunately,
that
you
riser
can't
complete
this
test.
I,
don't
know
which
which
cisco
failed,
but
it's
failed
and
if
we
use
we
pass
through
the
device
directly
into
the
into
the
cotta
containers
and
because
the
because
of
the
the
kata-kata
kernel
enabled
the
multi
kill
directory
by
default.
A
But
that's
doesn't
apply
to
that
to
the
house.
That's
because
the
house
OS,
that's
the
OST
OS
level
difference.
So
we
have
good
battle
performance
and
then
the
then
the
host
host
OS,
just
because
we
passed
through
the
devising
into
it
and
they
used
to
use
the
driver
with
mountain
kills
apart,
and
we
have
to
make
some
some
test
of.
Is
she
riser?
So
so
we
try
to
use
the
DD
yeah
the
DD
command,
to
do
some.
Some
did.
It
has
reached
90
and
also
with
the
mr.
A
t,
riser
and
containers
one
thing
I'd
like
to
say
the
the
9p.
If
we
use
a
1990
natively
90
is
its
kind
of
the
network
file
systems,
then
it's
include
a
client
and
a
server.
So
if,
if
you,
if
you
specify
I,
you
I
want
to
use
the
dirac
IO
in
the
in
the
in
the
client
part,
but
in
the
server
part
you
can
configure
it
to
use
that
you
rack
I,
also
so
the
for
the
photo
for
the
networking
for
that
for
the
I/o
part,
this
implies.
The
cache
is
here
so.
A
You
know
is
cut
here.
This
show
some
some
different
of
underperformance
and
for
the
for
the
smoke,
some
more
piece
of
the
of
the
reader
right.
The
this
is
the
divisor-
have
have
my
performance
penalty
here,
just
because
that
I
always
introduce
his
cars,
so
the
performance
guitar
and
for
networking
we
tried
different
different
configurations
and
we
see
I
I
selected,
one
one
configuration
to
make
the
device
or
performance
and
to
maximize
that.
You
revise
our
performance
here,
but
unfortunately,
I
think
this
is
also
other
means
because
of
the
penalty
of
the
of
the
Cisco's.
A
A
Yeah,
the
networking
tester
here
is
to
use
the
I,
prof
and
mining
for
the
follow
tcp
and
it's
in
the
in
the
local
area
in
the
land
land
has.
So
I
don't
think
there
will
be
many
many
magazines
because
the
the
of
the
congestion
control
mechanisms,
but
we
we
do
tack,
the
the
night
states
and
some
some
taters
there's
no
package
loss
here,
so
I
think
that's
that's
fire
and
also
we
may
introduce
some
some
UDP
tests
and
other
tests
yeah
yeah.
A
It's
about
the
potato
rate
and
there
is
should
be
a
time
time
for
request,
looks
like
looks
like
the
average
a
time
and
here
for
the
kata
and
and
receded
yeah
quite
similar-
and
here
is
a
note.
We
didn't.
They
use
the
9pf
is
for
the
for
the
cutout.
Has
you
know
if
you
use
the
hara
username
here?
The
Navy
will
introduce
some
some
some
penalty
here,
so
the
employee
in
Hindman.
They
invite
some
suggestion
for
the
production
use
it.
If
you
want
to
have
better
preference,
try
to
avoid
using
IP
address
and.
A
Here's
some
detailed
data
yeah
and
this
is
about
the
orange
line-
is
about
Takata
and
this
liest
received.
Almost
all
the
old
thing
is
the
only
person
hell
of
the
request,
urgency
and
the
kata
are
the
same.
That
looks
like
the
last
request.
The
maximum
the
max
was
the
kernel.
I,
don't
know
what
happened
but
which
repeats
many
times
there
is.
Why
requested
as
last
of
thought
for
24
200
milliseconds
I
know
there
is
some
some
sample.
A
They
meet
some
issues
on
the
on
the
fire
and
the
fire
scattering
things
will
be
ultimately
into
it
later
and
for
other,
for
others
quite
similar,
and
you
know
the
divisor
is
quite
smooth,
but
not
really
fast.
Yeah,
and
so
here
is
some
interesting
part
readies.
You
know,
you
know
the
radius
mixed
two
things
about
the
networking
access
and
the
memory,
so
the
people
always
used
to
try
this
as
a
as
a
rich
semantics
of
the
memory
camp
catch.
So
there
is
how
a
heavy
memory
operation
behind
behind
the
readies.
A
So
you
may
think
try
to
try
to
recall
your
your
that
the
previous
Peter
about
the
memory
things
and
so
here
is
the
the
benchmark
for
the
permit
for
most
of
the
of
the
different
operations
and
the
pair
in
the
para
metal.
The
the
kata
has
maybe
have
some
copy
in
the
in
some
of
the
operations,
but
here
others
are
quite
similar.
At
least
they
stand
at
the
same
levels,
but
you
guys
are
looks
not
so
good.
I
think
that's
mostly
about
the
come
from
the
memory
part
yeah
from
the
networking
part
yeah.
A
That's
because
the
networking
of
the
30
riser
in
your
other
has
two
shows
not
so
good.
So
you
know
the
next
next
slides
must
be
about
Neistat
virtualization
part
yeah,
the
middle
and
two
is
about
different
configuration
of
acara
and
the.
Firstly,
students
see
the
fluency
and
the
yellow
is
the
divisor.
A
So
go
back
come
again,
so
this
was
in
the
in
the
in
the
vm
in
the
nasa
virtualization,
we
may
have
some
performance
penalty
around
the
memory
part
for
the
photo
cotta
and
have
the
memory
performance
penalty
on
the
networking
part
for
the
divisor
yeah.
No
one
is
perfect,
it's
just
a
depends
on
which
one
is
worse.
A
A
So
another
test
is
about
tensorflow,
and
this
is
pure
sea
field
has
no
GPU
here,
yeah
we
working
on
the
GPU
subhodh
integration,
but
here
that
has
this
for
only
for
the
CPU
it
has,
and
this
shows
either
the
caja
and
the
divisor
looks
like
pretty
similar
yeah.
So
this
means
this
test
is
almost
a
purely
as
a
CP
CP
open
tester.
So
no
different,
no
significant
difference
between
the
different
container
enhance
and
here
I
can
summary,
both
the
cauda
and
the
divisor.
They
have
smores
attack
interface.
A
They
used
by
small,
a
small
set
of
the
Cisco's
for
the
for
the
host,
and
they
have
the
second
level
of
isolation,
so
there's
more
attack
in
their
face,
and
they
they
have
better
isolation,
that
Rossi
and
also
the
CPU
and
her
performance
is
identical
to
Houston
mercy.
So
if
your
your
application
is
a
pure
CPU
and
CPU
CPU
pumped
test
case
such
as
the
tensorflow
or
something
like
the
ffmpeg
for
the
for
the
coding,
encoding
and
decoding.
Oh
these,
all
these
cases
are
quite
similar.
They
they
have.
A
The
quite
similar
performance
and
for
the
character,
dinner's
use
the
device.
The
pass
room
may
have
better
performance
and
enable
that
Hamlet
and
the
shimrit
who
they
have
by
their
title
put'em
and
the
smaller
smaller
memory
footprint
and
also
in
most
cases
we
have
the
good
performance,
but
in
the
nasty
turn
nasty
the
authorization
mode,
we
will
meet
some
from
performance
penalty
for
the
other
memories
that
they
should
care
about
and
on
the
divisor.
A
Yes,
the
fastboot
performance
and
low
memory
footprint,
but
the
compatibility
is
not
really
good,
such
as
the
my
Seungho
and
kid
cologne
and
and
I
fire
off
a
load
looks
like
some.
Some
particle
semantics
will
failed
and
but
there's
no
method,
Nicaea
performance
penalty.
If
we
use
the
petrous
platform,
yes,
Peter
C
itself
is
slow
on
the
analysis.
How
interception
yeah
Anna
case
the
Petrus
is
slow,
but
but
it
it
will
play
identical.
A
Well,
do
in
the
in
the
water
machine,
oh
yeah
parameter,
yeah
I'm,
not
in
the
Petrus,
has
good
performance
just
just
mean
no,
no
party
on
the
night
see
the
authorization,
so
maybe
we
have,
we
will
have
Leo.
This
is
a
continuous
project
and
the
adventure
marks,
so
the
good
thing
is
maybe
I
can
I
can
friend
present
in
the
next
conference
and
we
will
have
more
find
Hyun.
A
Also,
we
are
thinking
about
fair
cracker
and
also
we
have
multiple.
We
will
have
multiple
networking
improvement,
also
for
the
for
the
panel
GPU
and
other
accelerator
support.
So
this
is
a
right
now
we
have.
We
are
pretty
mature,
protect
battles,
but
contributions.
Our
welcomes:
we
are
no
open
for
open
project
and
only
fair
connect.
Cracker
part.
Yes,
we
have
done
some
some
tests
from
so
we
have
already
have
a
pure
year
to
launch
the
container
through
the
fair
cracker
and
from
from
cata.
Yes,
we
have
done
that.
A
The
cool
part
is
the
fair
cracker
have
fewer
code,
and
the
writing
in
rust
that
may
die
implies
its
small
and
may
launch
a
fast
and
it
is,
it
doesn't
have
the
device
model,
so
it's
lightweight
and
also
is
from
it
applies,
and
that
means
its
various
points
is
have
a
large
user
set
and
help
it
to
become
mature.
That's
a
that's
the
cool
part
and
the
not
so
cool
part
is
welfare
cracker,
there's
no
hot
plaid.
Yet,
but
you
know
regularly,
the
carrot
depends
on
hot
practice.
A
We
insert
containers
into
the
into
the
into
the
the
pot,
and
this
is
what
CR
I
have,
and
so
maybe
we
need
to
more
work
about
this,
and
the
divisors
shows
the
light.
It's
lightweight
and
run
fast
under
not
really
fast,
no
Nancy,
the
virtualization
yeah,
so
auntie
riser
may
need
more
work
on
the
better
compatibility.
Yeah
and
also
we
have
another
project,
that's
based
on
the
Linux
kernel
and
doing
the
similar
to
the
G
visor,
and
we
have
a
presentation
in
Vancouver
I
think
the
idea
on
the
end
of
August.
A
A
A
Not
not
no,
so
you
know
part
is
about
if
we
try
to
try
to
do
it
with
some
series.
That
means
the
series
mats
has
been
public
and
if
a
severe
as
public
than
it
is
fixed
in
the
may
life,
so
so
that's
pretty
pretty
hard
to
make
it
automatically
it
has
tested,
but
you
can
do
some
manual
it
has
it.
I
have
has
I,
have
posted
some
some
some
demo
demo
video
on
YouTube
to
to
showcase
some
series
in
the
to
just
to
compromise
the
addressing
container
and
but
for
Kara
containers
desktop.