Kata Containers for CI: Boot Cost Isn't the Problem, File I/O Is

Thu, 03 Sep 2026 21:35:00 -0700

Of the three platforms ephemerd runs jobs on, Linux has the weakest isolation. Windows jobs get a Hyper-V isolated container with its own kernel. macOS jobs get a whole VM. A Linux job is an ordinary runc container sharing the host kernel. A kernel escape from a Linux job is a host compromise. Kata Containers fixes that by putting each container in a lightweight VM with its own kernel. It plugs into containerd as just another runtime handler. So I added it in #155, measured it, and left it off by default. This post is why.

Kvm on Luther Monson

Kata Containers for CI: Boot Cost Isn't the Problem, File I/O Is