Updates and recent posts about Kata Containers..

Posts
Description

Link

@kaptain shared a link, 3 weeks, 3 days ago

FAUN.dev()

Cluster API v1.12: Introducing In-place Updates and Chained Upgrades

Cluster API v1.12.0 addsin-place updatesandchained upgrades, so machines can swap parts without going down, and clusters can jump versions without drama. KubeadmControlPlaneandMachineDeploymentsnow choose between full rollouts or surgical patching, depending on what changed. The goal: keep clusters .. read more

Link

@kaptain shared a link, 3 weeks, 3 days ago

FAUN.dev()

Run a Private Personal AI with Clawdbot + DMR

Clawdbot just plugged intoDocker Model Runner (DMR). That means you can now run your own OpenAI-compatible assistant, locally, on your hardware. No cloud. No per-token fees. No data leaking into the void!.. read more

Link

@kaptain shared a link, 3 weeks, 3 days ago

FAUN.dev()

Ingress NGINX: Statement from the Steering and Security Response Committees

Kubernetes is cutting offIngress NGINXin March 2026. No more updates. No bug fixes. No security patches. Done. Roughly half of cloud-native setups still rely on it, but it's been understaffed for years. If you're one of them, it's time to move. There’s no plug-and-play replacement, but the ecosystem.. read more

Link

@kaptain shared a link, 3 weeks, 3 days ago

FAUN.dev()

New Conversion from cgroup v1 CPU Shares to v2 CPU Weight

A new quadratic formula now mapscgroup v1 CPU sharestocgroup v2 CPU weight. Why? Because the old linear approach messed with CPU fairness; especially at low share values. This fix nails prioritization where it counts. It lands at theOCI runtime layer, live inrunc v1.3.2andcrun v1.23, so containers f.. read more

Link

@kala shared a link, 3 weeks, 3 days ago

FAUN.dev()

AWS Frontier Agents: Kiro, DevOps Agent, and Security Agent

“Frontier Agents” drop straight into incident workflows. They kick off investigations on their own, whether triggered by alarms or a human hand, pulling together logs, metrics, and deployment context fast. Findings show up where they’re needed: Slack threads, tickets, operator dashboards. No shell c.. read more

Link

@kala shared a link, 3 weeks, 3 days ago

FAUN.dev()

Securing Agents in Production (Agentic Runtime, #1)

Palantir's AIP Agentic Runtime isn't just another agent platform, it's a control plane with teeth. Think tight policy enforcement, ephemeral autoscaling with Kubernetes (Rubix), and memory stitched in from the jump viaOntology. Tool usage? Traced and locked down with provenance-based security. Every.. read more

Link

@kala shared a link, 3 weeks, 3 days ago

FAUN.dev()

Is that allowed? Authentication and authorization in Model Context Protocol

TheModel Context Protocol (MCP) 2025-11-25spec tightens up remote agent auth. It leans intoOAuth 2.1 Authorization Code grants, PKCE required, step-up auth backed. No token passthrough allowed. What’s new: experimental extensions forclient credentialsandclient ID metadata. These smooth out agent reg.. read more

Link

@kala shared a link, 3 weeks, 3 days ago

FAUN.dev()

Keeping 20,000 GPUs healthy

Modal unpacked how it keeps a 20,000+ GPU fleet sane across AWS, GCP, Azure, and OCI. Think autoscaling, yes, but with some serious moves behind the curtain. They're running instance benchmarking, enforcing machine image consistency, running boot-time checks, and tracking GPU health both passively a.. read more

Link

@devopslinks shared a link, 3 weeks, 3 days ago

FAUN.dev()

Moltbot Personal Assistant Goes Viral, And So Do Your Secrets

Moltbot, the self-hosted AI agent with native hooks for Slack, Telegram, and WhatsApp, exploded from 50-ish to over 3,000 GitHub forks a day after going viral on Jan 24, 2026. It's built around a file-backed workspace and automates everything from code deploys to cloud orchestration. Cool? Definitel.. read more

Link

@devopslinks shared a link, 3 weeks, 3 days ago

FAUN.dev()

Supply-chain risk of agentic AI - infecting infrastructures via skill worms

AI assistants with shell, network, or filesystem "skills" don't just help, they expose. These hooks can run commands before any human checks the model’s output. That means a bigger attack surface. More room for lateral movement. Easier persistence. In setups where tools like Claude Code run often, i.. read more

Kata Containers is a Cloud Native Computing Foundation (CNCF) project designed to close the security gap between traditional Linux containers and virtual machines. Instead of sharing a single host kernel like standard containers, Kata Containers launches each pod or container inside its own lightweight virtual machine using hardware virtualization.

This approach dramatically reduces the attack surface and prevents container escape vulnerabilities, making Kata ideal for multi-tenant, untrusted, or sensitive workloads. Despite using VMs under the hood, Kata is optimized for fast startup times and integrates seamlessly with Kubernetes through the Container Runtime Interface (CRI), allowing it to be used alongside runtimes like containerd and CRI-O.

Kata Containers is commonly used in scenarios such as multi-tenant Kubernetes clusters, confidential computing, sandboxed AI workloads, serverless platforms, and agent execution environments where strong isolation is mandatory. It supports multiple hypervisors, including QEMU, Firecracker, and Cloud Hypervisor, and continues to evolve toward faster boot times, lower memory overhead, and better hardware acceleration support.