Deploy Kata Containers

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget gnupg2 apt-transport-https \
  ca-certificates software-properties-common lsb-release

# Check for KVM support
grep -cw vmx /proc/cpuinfo     # Intel (should return > 0)
grep -cw svm /proc/cpuinfo     # AMD (should return > 0)

# Verify /dev/kvm exists
ls -la /dev/kvm

# Install and run kvm-ok
sudo apt install -y cpu-checker
kvm-ok

# Create a deploy user
adduser deploy
usermod -aG sudo deploy

# Copy SSH keys
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

# Switch to the new user
su - deploy

# Add Docker's official GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the Docker repository
echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install containerd
sudo apt update
sudo apt install -y containerd.io

# Generate default config
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml

# Enable systemd cgroup driver
sudo sed -i "s/SystemdCgroup = false/SystemdCgroup = true/" \
  /etc/containerd/config.toml

# Restart containerd
sudo systemctl restart containerd
sudo systemctl enable containerd

# Download and install the Kata Containers GPG key
ARCH=$(uname -m)
BRANCH="stable-3.x"

sudo mkdir -p /etc/apt/keyrings
wget -qO- https://packages.kata-containers.io/kata-containers/\
releases/keys/kata-containers-release.key | \
  sudo gpg --dearmor -o /etc/apt/keyrings/kata-containers.gpg

# Add the repository
echo "deb [signed-by=/etc/apt/keyrings/kata-containers.gpg] \
  http://packages.kata-containers.io/kata-containers/\
stable/ubuntu/$(lsb_release -cs)/ main" | \
  sudo tee /etc/apt/sources.list.d/kata-containers.list

# Install Kata Containers
sudo apt update
sudo apt install -y kata-containers

# Verify the installation
kata-runtime --version

# Run the environment check
sudo kata-runtime check

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
  runtime_type = "io.containerd.kata.v2"
  privileged_without_host_devices = true

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata.options]
  ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration.toml"

sudo systemctl restart containerd
sudo systemctl status containerd

# Download nerdctl
NERDCTL_VERSION=$(curl -s https://api.github.com/repos/\
containerd/nerdctl/releases/latest | grep tag_name | \
cut -d \" -f 4 | sed "s/v//")

wget https://github.com/containerd/nerdctl/releases/download/\
v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-amd64.tar.gz

# Install
sudo tar -xzf nerdctl-${NERDCTL_VERSION}-linux-amd64.tar.gz \
  -C /usr/local/bin/

# Install CNI plugins (required for networking)
CNI_VERSION=$(curl -s https://api.github.com/repos/\
containernetworking/plugins/releases/latest | grep tag_name | \
cut -d \" -f 4 | sed "s/v//")

sudo mkdir -p /opt/cni/bin
wget https://github.com/containernetworking/plugins/releases/download/\
v${CNI_VERSION}/cni-plugins-linux-amd64-v${CNI_VERSION}.tgz
sudo tar -xzf cni-plugins-linux-amd64-v${CNI_VERSION}.tgz -C /opt/cni/bin/

sudo nerdctl run --rm -it alpine uname -r
# Returns the host kernel version (containers share the host kernel)

sudo nerdctl run --rm -it --runtime io.containerd.kata.v2 alpine uname -r
# Returns a DIFFERENT kernel version — the Kata guest kernel
# This confirms hardware-level VM isolation

# Run Nginx in a Kata container
sudo nerdctl run -d --name kata-nginx \
  --runtime io.containerd.kata.v2 \
  -p 8080:80 nginx:alpine

# Verify it's running
sudo nerdctl ps

# Test the web server
curl http://localhost:8080

# Check the kernel inside the container
sudo nerdctl exec kata-nginx uname -r

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata
handler: kata

# Apply the RuntimeClass
kubectl apply -f kata-runtimeclass.yaml

# Deploy a pod with Kata isolation
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: kata-nginx
spec:
  runtimeClassName: kata
  containers:
  - name: nginx
    image: nginx:alpine
    ports:
    - containerPort: 80
EOF

# Verify the pod is running
kubectl get pods kata-nginx

# Confirm Kata runtime
kubectl exec kata-nginx -- uname -r

[hypervisor.clh]
path = "/opt/kata/bin/cloud-hypervisor"
kernel = "/opt/kata/share/kata-containers/vmlinux-clh.container"
image = "/opt/kata/share/kata-containers/kata-containers.img"

# Under [hypervisor.qemu]
default_memory = 2048     # MB per container VM
memory_slots = 10         # Hot-pluggable memory slots
memory_offset = 0

# Enable memory hotplug for dynamic scaling
enable_mem_prealloc = false
enable_hugepages = false  # Enable if host has hugepages

default_vcpus = 2
default_maxvcpus = 4

disable_new_netns = false
sandbox_cgroup_only = true

# Enable seccomp
enable_seccomp = true

# Debug mode (for troubleshooting)
kernel_params = "agent.log=debug agent.hotplug_timeout=10"

# Production mode (recommended)
kernel_params = "quiet"

# Create isolated network
sudo nerdctl network create kata-isolated \
  --subnet 172.28.0.0/16

# Run container on isolated network
sudo nerdctl run -d --name secure-app \
  --runtime io.containerd.kata.v2 \
  --network kata-isolated \
  your-app:latest

# Apply UFW rules
sudo ufw allow from 172.28.0.0/16 to any port 5432
sudo ufw deny from 172.28.0.0/16 to any

# Check Kata runtime info for a running container
sudo kata-runtime env

# View containerd events
sudo nerdctl events

# Monitor resource usage
sudo nerdctl stats

# In configuration.toml, set:
# enable_debug = true

# View Kata runtime logs
sudo journalctl -u containerd -f | grep kata

# View hypervisor logs
sudo journalctl -t kata-runtime

# Full system check
sudo kata-runtime check --verbose

# Check containerd runtime plugins
sudo ctr plugins ls | grep kata

# Verify containerd config includes Kata
containerd config dump | grep -A5 kata

# Test container creation in debug mode
sudo kata-runtime --log=/tmp/kata.log \
  --log-level=debug

# List all containers
sudo nerdctl ps -a

# Remove stopped containers
sudo nerdctl container prune -f

# Remove unused images
sudo nerdctl image prune -f

# Update from package repository
sudo apt update
sudo apt upgrade kata-containers

# Verify the new version
kata-runtime --version

# Restart containerd to pick up changes
sudo systemctl restart containerd