Join us

ContentUpdates and recent posts about Kata Containers..
Link
@varbear shared a link, 1 month, 4 weeks ago
FAUN.dev()

PostgreSQL MVCC, Byte by Byte

PostgreSQL's MVCC stores two 32-bit XIDs per tuple -xminandxmax. The transaction snapshot decides visibility per tuple. Updates append new tuples and mark the old withxmax.VACUUMreclaims versions only when no active snapshot can see them. Long-runningREPEATABLE READsnapshots pin versions and cause b.. read more  

PostgreSQL MVCC, Byte by Byte
Link
@kaptain shared a link, 1 month, 4 weeks ago
FAUN.dev()

From public static void main to Golden Kubestronaut: The Art of unlearning

The author left JVM monolith ops forKubernetes. They stacked certs:CKA,CKAD,CKS,KCNA,KCSA,CNCF Golden Kubestronaut. They treatPodsas the atomic deployable. They pick fights:IngressvsNodePort. They warn aboutConfigMapdrift. They spotlight runtime primitives:Horizontal Pod Autoscalerandservice meshfor.. read more  

From public static void main to Golden Kubestronaut: The Art of unlearning
Link
@kaptain shared a link, 1 month, 4 weeks ago
FAUN.dev()

Why MicroVMs: The Architecture Behind Sandboxes

Docker Sandboxes puts each agent session in a dedicatedmicroVM. Each microVM runs a privateDocker daemoninside the VM boundary. That blocks access to the host. A new cross‑platformVMMruns on macOS, Windows, and Linux hypervisors. It slashes cold starts and runs fullDockerbuild, run, and compose work.. read more  

Why MicroVMs: The Architecture Behind Sandboxes
Link
@kaptain shared a link, 1 month, 4 weeks ago
FAUN.dev()

The AI-driven shift in vulnerability discovery: What maintainers and bug finders need to know

AI modelslet non-experts craft real and fake vulnerabilities at scale. They spit out low-quality noise and the occasional high-value report. Reports floodOSS maintainers. Triage, patching, release cadences, and downstreamupgrade/compliancepipelines buckle under the load. Guidance recommends publishi.. read more  

The AI-driven shift in vulnerability discovery: What maintainers and bug finders need to know
Link
@kaptain shared a link, 1 month, 4 weeks ago
FAUN.dev()

v1.36: User Namespaces in are finally GA

Kubernetesv1.36promotesUser Namespacesto GA on Linux. It brings rootless workload isolation. Kubelet leans on kernelID-mapped mounts. It sidesteps expensivechownby remappingUID/GIDat mount time and confines privileged processes. No more mass-chown screams... read more  

Link
@kaptain shared a link, 1 month, 4 weeks ago
FAUN.dev()

Building a fault-tolerant metrics storage system at Airbnb

Airbnb built a metrics system that ingests50M samples/s, stores2.5PBof logical time series, and hosts1.3B active series. They use tenant-per-service grouping andshuffle sharding. They enforce per-tenant guardrails and a consolidatedcontrol plane. They shard queries and compaction. They run zone-awar.. read more  

Building a fault-tolerant metrics storage system at Airbnb
Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

Introducing Coregit

Coregit reimplements Git's object model inTypeScriptand runs onCloudflare Workersas a serverless edge Git API. Its commit endpoint accepts up to 1,000 file changes per request and replaces 105+ GitHub calls with one. Yes - one. It acknowledges writes inDurable Objects(~2ms), then flushes objects toR.. read more  

Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

How LLMs Work — A Visual Deep Dive

A complete walkthrough of how large language models like ChatGPT are built, from raw internet text to a conversational assistant... read more  

How LLMs Work — A Visual Deep Dive
Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

The PR you would have opened yourself

ASkillports models fromtransformerstomlx-lm. It bootstraps an env, discovers variants, downloads checkpoints, writes MLX implementations, and runs layered tests. It produces disclosed PRs with per-layer diffs, dtype checks, generation examples, numerical comparisons, and a reproducible, non-agentict.. read more  

The PR you would have opened yourself
Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

Introducing Ternary Bonsai: Top Intelligence at 1.58 Bits

PrismML unveilsTernary Bonsai: a family of1.58-bitLMs in1.7B,4B, and8Bsizes. Models use ternary weights {-1,0,+1} with group-wise quantization. Weights are ternary (-1,0,+1). Each group of128weights shares anFP16scale. That cuts memory by ~9x versus 16-bit and boosts benchmark scores. The8Bhits 75.5.. read more  

Introducing Ternary Bonsai: Top Intelligence at 1.58 Bits
Kata Containers is a Cloud Native Computing Foundation (CNCF) project designed to close the security gap between traditional Linux containers and virtual machines. Instead of sharing a single host kernel like standard containers, Kata Containers launches each pod or container inside its own lightweight virtual machine using hardware virtualization.

This approach dramatically reduces the attack surface and prevents container escape vulnerabilities, making Kata ideal for multi-tenant, untrusted, or sensitive workloads. Despite using VMs under the hood, Kata is optimized for fast startup times and integrates seamlessly with Kubernetes through the Container Runtime Interface (CRI), allowing it to be used alongside runtimes like containerd and CRI-O.

Kata Containers is commonly used in scenarios such as multi-tenant Kubernetes clusters, confidential computing, sandboxed AI workloads, serverless platforms, and agent execution environments where strong isolation is mandatory. It supports multiple hypervisors, including QEMU, Firecracker, and Cloud Hypervisor, and continues to evolve toward faster boot times, lower memory overhead, and better hardware acceleration support.