kata-containers

No entries match these filters. Clear filters

1. 4.3.0 Oct 20, 2026 · issue 115

   Kata 4.3.0 adds rootless SEV-SNP/TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment., GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. driver repo support, guest-extension VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. expansion, and deeper webhook memory enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.3.0 https://github.com/kata-containers/kata-containers.git
   # already have the repo? check out this version:
   $ git checkout 4.3.0

   └──▷ USE IT
   Point nvgpu at a dedicated driver userspace repository or a full driver source tarball so every GPU runtime class component is built and shipped.
   yaml copy

   # In the nvgpu driver configuration, set driver.url to a dedicated repository or a complete tarball:
   driver:
     url: "https://internal-mirror.example.com/nvidia-driver-570.tar.gz"

   • Enables rootless SEV-SNP and TDX in runtime-rs/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., allowing confidential VMs to run without root privileges.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ability to enforce a minimum memory limit in the kata-webhook.
   • Adds support for a dedicated driver userspace repository for NVIDIA GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. via driver.url in nvgpu.
   • Accepts a complete driver source tarball as driver.url for NVIDIA GPU builds.
   • Expands guest-extensions support to VMMs beyond QEMU, updates Cloud Hypervisor to v53.0, and bumps the guest kernel to 6.18.52.

   +5 more show less

   • Adds agent capabilities to unseal sealed secret environment variables during exec requests, report cgroup v2 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. throttling time, and fall back to fsmount when overlay options exceed 4K.
   • Adds kata-deploy support to provision host devices for rootless VMMs and to detect external Node Feature Discovery (NFD) by label.
   • Verifies guest-pulled image references in genpolicy.
   • Improves genpolicy by adding a default PATH when the container image environment lacks one and by naming the missing Secret or ConfigMap when an env source is absent.
   • Improves kata-deploy by restricting containerd pod_annotations to the per-installation configuration and honoring imagePullSecrets on kubectl-image hook Jobs.
   • Enables rootless SEV-SNP and TDX in runtime-rs/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., allowing confidential VMs to run without root privileges.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ability to enforce a minimum memory limit in the kata-webhook.
   • Adds support for a dedicated driver userspace repository for NVIDIA GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. via driver.url in nvgpu.
   • Adds agent capabilities to unseal sealed secret environment variables during exec requests, report cgroup v2 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. throttling time, and fall back to fsmount when overlay options exceed 4K.
   • Adds kata-deploy support to provision host devices for rootless VMMs and to detect external Node Feature Discovery (NFD) by label.

   +1 more show less

   • Verifies guest-pulled image references in genpolicy.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The image_guest_pull driver option metadata is removed from genpolicy, agent, and runtime(-rs) — configurations or policies that set this field will break.
2. 4.2.0 Sep 15, 2026 · issue 075

   Kata Containers 4.2.0 adds TLS to kata-monitor, VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space./block-device fd passing for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., virtio-rngvirtio-rngA paravirtualized random-number-generator device defined by the virtio standard, letting a virtual machine pull entropy from its hypervisor host to seed the guest's entropy pool faster than emulated hardware allows. for dragonball, and early guest console log capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.2.0 https://github.com/kata-containers/kata-containers.git
   # already have the repo? check out this version:
   $ git checkout 4.2.0

   • Adds TLS support to kata-monitor for encrypted metrics exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Passes block storage sources by file descriptor in runtime-rs/QEMU, enabling more secure and flexible block device attachment.
   • Passes VFIO devices by file descriptor in runtime-rs/QEMU, enabling fd-based VFIO device handoff.
   • Adds virtio-rng entropy device to the dragonball VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely..
   • Captures early guest console logs in the runtime before the agent is fully up.

   +5 more show less

   • Allows disabling CLH nested virtualization in the runtime.
   • Enables cold-plug of block devices requested before boot in runtime-rs with Cloud Hypervisor.
   • Ships dcgm-exporter in the NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. guest images.
   • Enables NFD (Node Feature Discovery) in the NVIDIA kata-deploy presets.
   • Bumps rootfs base to Ubuntu 26.04 across all images.
   • Adds TLS support to kata-monitor for encrypted metrics exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Passes block storage sources by file descriptor in runtime-rs/QEMU, enabling more secure and flexible block device attachment.
   • Passes VFIO devices by file descriptor in runtime-rs/QEMU, enabling fd-based VFIO device handoff.
   • Adds virtio-rng entropy device to the dragonball VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely..
   • Captures early guest console logs in the runtime before the agent is fully up.

   +2 more show less

   • Allows disabling CLH nested virtualization in the runtime.
   • Ships dcgm-exporter in the NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. guest images.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The disable_block_device_use option is removed from runtime-rs as it was unsupported — configs referencing it will need to be updated.
   • !The cpu_nested_config override is removed from runtime-rs.
3. 4.1.0 Aug 21, 2026 · issue 053

   Kata Containers 4.1.0 adds OpenVMM and Cloud Hypervisor VM template support, L3 forwarding network model, NVSwitch passthrough, and EROFS backing mode in kata-deploy.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.0 https://github.com/kata-containers/kata-containers.git
   # already have the repo? check out this version:
   $ git checkout 4.1.0

   • Adds shared_fs=none configuration to kata-deploy so virtiofsd is not shipped when it is not needed.
   • Adds EROFS backing mode configuration support in kata-deploy.
   • Adds values overlay support when publishing the Helm chart in kata-deploy.
   • Adds listxattr to the dragonball seccomp allowlist in runtime-rs, enabling workloads that call this syscall.
   • Adds L3 forwarding network model for runtime-rs, enabling an additional network topology option.

   +22 more show less

   • Adds OpenVMM hypervisor support in runtime-rs.
   • Adds Cloud Hypervisor VM template support in runtime-rs.
   • Adds nvswitch-class device passthrough support in the runtime, enabling NVSwitch-based GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. topologies.
   • Adds VIRTIO_F_ACCESS_PLATFORM flag for TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. virtio devices in dragonball, improving TDX guest compatibility.
   • Adds a hypercall (VcpuExit::Hypercall) handler for TDX in dragonball.
   • Adds a generic devkit debug guest extension (runtime-rs only).
   • Adds composable VM extensions for IBM SEL in runtime-rs.
   • Splits the static release tarball by runtime, producing per-runtime tarballs.
   • Adds a qemu-no-shared-fs build variant and trims confidential-guest QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. builds.
   • Disables QEMU features and devices by default to reduce the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   • Adds podLabels support on per-node Jobs in kata-deploy.
   • Adds TEE key advertisement rendering from the Helm chart in kata-deploy.
   • Enables job-mode dispatcher confinement to trusted nodes in kata-deploy.
   • Isolates guest debug in runtime classes within kata-deploy.
   • Drops nsenter from kata-deploy and tightens host privileges.
   • Shares block storage source mapping in runtime-rs to reduce duplication.
   • Bumps virtiofsd to 1.14.0.
   • Binds nydus-snapshotter to the node's actual CRI unit in kata-deploy.
   • Makes kata-deploy roll out when mounted ConfigMaps change via Helm.
   • Local CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. repository support added for NVIDIA GPU extensions (nvgpu).
   • Extracts PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. utilities into a standalone pcilibs-rs crate.
   • Places the runtime in the sandbox cgroup synchronously in runtime-rs, improving resource accounting.

   27 details in Everything

4. advisory CVE-2026-77176 Aug 20, 2026 · issue 128
   • CVE-2026-77176: generated policy allows mounting attacker-chosen guest paths to specific locations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. advisory CVE-2026-86072 Jul 21, 2026 · issue 128
   • CVE-2026-86072: Untrusted pod annotation bind-mounts any host path into the Kata guest, bypassing the operator allowlist (affects <= 3.32.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-93417 Jul 21, 2026 · issue 128
   • CVE-2026-93417: Dragonball: missing length validation in virtio-blk allows guest-to-host VM escape (affects >= 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-64676 Jul 21, 2026 · issue 128
   • CVE-2026-64676: kata-agent mem-agent ttRPC methods are not subject to agent-policy enforcement, letting an untrusted host tamper with confidential-guest memory management (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.7, affects <= 3.31.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-50540 Jul 20, 2026 · issue 128
   • CVE-2026-50540: Config Path Annotation Arbitrary File Loading (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects <=3.32.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. 4.0.0 Jul 20, 2026 · issue 041

   Kata Containers 4.0 rewrites the runtime in Rust, ships Dragonball VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. by default, and adds dm-verity, EROFS, virtio-mem, and VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. cold-plug.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.0.0 https://github.com/kata-containers/kata-containers.git
   # already have the repo? check out this version:
   $ git checkout 4.0.0

   • Introduces runtime-rs, a full Rust rewrite of the Kata Containers runtime, now the default runtime replacing the original Go runtime.
   • Adds Dragonball as a built-in VMM default, supporting virtio-net, virtio-blk, and VFIO device passthrough without requiring QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. or Cloud Hypervisor.
   • Adds support for EROFS snapshotter, available through Helm configuration, with kata-deploy validating EROFS prerequisites before installation.
   • Adds dm-verity integrity-verified root filesystem support, enabled by default in deployment configurations.
   • Adds block-based emptyDir volumes (block-plain) for improved performance and security, avoiding filesystem sharing.

   +14 more show less

   • Adds virtio-mem memory hotplug support in runtime-rs.
   • Adds VFIO device cold-plug support, including CDI-based VFIO cold-plug in single-container (non-pod-sandbox) mode.
   • Adds s390x VFIO-AP mediated device support for IBM Z crypto and accelerator workloads.
   • Adds a unified block device model (BlockModern) across QEMU, Cloud Hypervisor, and Dragonball, with improved hot-plug/unplug reliability and rollback on failure.
   • Adds discard and unmap support for thin-provisioned storage (requires hypervisor support).
   • Adds GPT/VMDK support for integrity-verified root filesystems.
   • Adds improved virtio-scsi support as a container root filesystem driver.
   • Propagates multi-queue networking configuration through all supported hypervisors (QEMU, Cloud Hypervisor, Dragonball).
   • Adds support for placing network devices in the host network namespace when using QEMU.
   • Adds improved network interface hot-plug for QEMU with enhanced SR-IOV support.
   • Improves static sandbox resource sizing to account for runtime overhead values, benefiting Kubernetes Pod Overhead and scheduling accuracy.
   • Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. device support across QEMU, Cloud Hypervisor, and Dragonball hypervisors.
   • Expands supported hardware architectures in runtime-rs to x86_64, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. (aarch64), and IBM s390x.
   • Updates containerd shim to version 0.11 and ttrpc to version 0.9 as part of the Rust runtime dependency refresh.

   19 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The original Go runtime is deprecated and kata-deploy sets the RuntimeClass to runtime-rs by default — existing users may encounter minor differences in configuration and behavior when upgrading.
   • !Unsafe emptyDir setting that allowed volumes to exceed their sizeLimit has been removed.
   • !Unused VFIO configuration options were removed.
10. 3.32.0 Jun 22, 2026 · release notes

    Kata Containers 3.32.0 adds Kata-monitor standalone image, Job-based deployment, TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. ACPI/guest memfd support, and erofs/iothread/nycus capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.32.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.32.0

    • kata-monitor is shipped as a standalone multi-arch image starting with 3.32.0
    • Add a Job-based deployment mode to kata-deploy (alternative to the privileged DaemonSet)
    • Add basic ACPI implementation for TDX boot in dragonball
    • Add implementation for KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed.-managed guest memfd in dragonball
    • Support erofs snapshotter with gpt vmdk mode in runtime-rs

    +4 more show less

    • Support Independent iothreads in runtime-rs
    • Nydus standalone mode support in runtime-rs
    • Add support for monitoring disk usage via statfs to Metrics
    • Use /etc/containerd/conf.d/ drop-in for containerd >= 2.2.0

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !file_mem_backend config option removed in runtime-rs
11. advisory CVE-2026-47243 May 21, 2026 · issue 128
    • CVE-2026-47243: runtime-rs: Guest-root to host-root escape via virtiofs (affects <= 3.30.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
12. advisory CVE-2026-44210 May 20, 2026 · issue 128
    • CVE-2026-44210: VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9, affects <= 3.29.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
13. 3.31.0 May 19, 2026 · release notes

    Kata Containers 3.31.0 adds coldplug GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support, HTTP health probes, and genpolicy env source from metadata labels.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.31.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.31.0

    • runtime-rs: add CCW network hotplug capability for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. VMs
    • kata-deploy now exposes HTTP health probes at /healthz and /readyz endpoints
    • genpolicy supports environment variable values sourced from metadata.labels
    • runtime-rs adds coldplug GPU support

    4 details in Everything

14. 3.30.0 May 2, 2026 · release notes

    runtime-rs gains vCPU thread pinning, splits irqchip via Dragonball userspace IOAPIC, and supports containerd v4 config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.30.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.30.0

    • runtime-rs now includes vCPU thread pinning support for finer control over VM CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. allocation.
    • dragonball gains a userspace IOAPIC implementation to enable the split irqchip architecture.
    • kata-deploy adds support for containerd config version 4, removing compatibility gaps with newer containerd setups.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !agent has removed the standard-oci-runtime feature, dropping support for that runtime mode in favor of the standard OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. implementation.
15. advisory CVE-2026-41326 Apr 22, 2026 · issue 128
    • CVE-2026-41326: CopyFile Policy Subversion via Symlinks (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.2, affects v3.4.0 - v3.28.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
16. 3.29.0 Apr 22, 2026 · release notes

    Adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. cold-plug support for CLH, sector size config for block devices, and QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. ppc64le support in runtime-rs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.29.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.29.0

    • clh: Add VFIO device cold-plug support to the Cloud Hypervisor runtime
    • runtime: allow specifying logical/physical sector size for block devices via configuration
    • runtime-rs: add QEMU support for ppc64le architecture
    • runtime-rs: Enhance TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. in qemu with new capabilities
    • agent: add mkfs_opts parameter to cdh_secure_mount function

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !dbg_monitor_socket config key is renamed (change in name affects existing configs)
    • !runtime-rs now denies configuration of unknown fields, rejecting previously silent invalid keys
17. 3.28.0 Mar 17, 2026 · release notes

    Adds configurable pod overhead per-shim and hotplug support for memory/block on s390x in Kata Containers v3.28.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.28.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.28.0

    └──▷ HOW TO FIND IT
    Tune resource overhead specifically for shim-v2-go pods using the new kata-deploy configuration option.
    📍# In your values.yaml or helm install command, add per-shim pod overhead: # pod_overhead_per_shim: # shim-v2-go: 50m # shim-kata-collectd: 10m
    • Adds per-shim configurable pod overhead in kata-deploy to tune resource limits individually for each shim type (e.g. shim-v2-go).
    • Adds support for memory hotplug via virtio-mem on s390x architecture.
    • Adds support for block device hotplug on s390x architecture in the runtime-rs component.
    • Implements trusted ephemeral data storage in the coco subsystem.

    4 details in Everything

18. advisory CVE-2026-24834 Feb 19, 2026 · issue 128
    • CVE-2026-24834: Kata Container to Guest micro VM privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.3, affects <= 3.26.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
19. 3.27.0 Feb 19, 2026 · release notes

    kata-deploy updates strategy configurable, CRI-O device cold-plug annotations, configurable network_queues, TEE nodeSelectors, genpolicy allowlist/suppression

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.27.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.27.0

    └──▷ USE IT
    Control how kata-deploy rolls out updates to nodes instead of the default strategy.
    config copy

    # In your kata-deploy config (e.g. values.yaml or DaemonSet manifest):
    update_strategy: "RollingUpdate" # or "OnDelete"

    Generate policy output directly as base64 or raw string instead of YAML for easier parsing in CI.
    copy

    $ genpolicy --base64-out -f policy.yaml > policy.b64
    # or
    genpolicy --raw-out -f policy.yaml

    • update_strategy config option in kata-deploy to control DaemonSet update strategy
    • cri-o.device-coldplug annotation support in shim for device hot-add without restart
    • network_queues configuration and annotation in runtime-rs for configurable network queue counts
    • TEE nodeSelectors automatically added by kata-deploy when NFD is detected
    • --{base64/raw}-out flags in genpolicy to suppress YAML output

    +2 more show less

    • allowlist support for multiple NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. resource keys in genpolicy vfio settings
    • RO and RW sysfs permissions allowed in genpolicy for privileged containers

    7 details in Everything

20. advisory CVE-2026-24054 Jan 29, 2026 · issue 128
    • CVE-2026-24054: Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 10.0, affects <= 3.25.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
21. 3.26.0 Jan 29, 2026 · release notes

    New TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment./SNP runtimeclasses, arm64 QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. support in runtime-rs, iommufd enforcement for confidential guest VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space., and containerd v2.0+ -info flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.26.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.26.0

    • kata-deploy now includes runtime-rs TDX / SNP runtimeclasses for deploying Intel Trust Domain Extensions and AMD Secure Nested Paging workloads.
    • The runtime-rs binary adds arm64 QEMU support, enabling the Rust runtime on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. hosts without relying on the legacy Go implementation.
    • The shim now enforces iommufd for confidential guest VFIO device assignment, ensuring strict IOMMU isolation for secure VMs.
    • Both runtime and runtime-rs add -info flag support to query metadata for containerd v2.0+ compatibility.

    4 details in Everything

22. 3.25.0 Jan 19, 2026 · release notes

    Kata Containers 3.25.0 adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP support on s390x, measured rootfs build support, and a kata-remote Helm runtime class.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.25.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.25.0

    └──▷ USE IT
    Verify the Kata agent is healthy after Helm installation.
    shell copy

    helm install kata kata/kata-containers --set kata.postInstallVerification.enabled=true

    Build a measured rootfs using the new Makefile targets.
    shell copy

    cd src/runtime-rs
    make measured-rootfs # Uses dedicated configuration keys

    • runtime-rs enables VFIO-AP hardware pass-through (hotplug only) for s390x platforms
    • kata-deploy adds post-install verification for the Helm chart via the post-install hook
    • runtime-rs supports measured rootfs builds through dedicated Makefile targets and configuration keys
    • Helm release provides a kata-remote runtime class definition

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !runk is officially deprecated in 3.25.0 and will be removed in 3.26.0
23. 3.24.0 Dec 12, 2025 · release notes

    Kata Containers 3.24.0 adds device cold plug support, virtio-blk iothreads, IOMMUFD QMP commands, and dynamic queue config via Pod annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.24.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.24.0

    • Adds IOMMUFD object creation capabilities for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. QMP commands within the runtime to improve GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. device passthrough management.
    • Introduces an iothreads framework for virtio-blk devices, allowing independent I/O processing threads for storage performance.
    • Updates the genpolicy tool to support both runtime-rs and runtime-go runtimes through a unified cpath compatibility layer.

    3 details in Everything

24. 3.23.0 Nov 18, 2025 · release notes

    Kata Containers 3.23.0 adds kata-ctl factory subcommands for VM templates, structured shim configs, and TEE NodeFeatureRules deployment.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.23.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.23.0

    • Adds kata-ctl vm-template factory subcommands for VM template management
    • Introduces a new structured configuration format for shims in the kata-deploy helm chart to replace the legacy env.* fields
    • Kata-deploy now automatically deploys NodeFeatureRules for Trusted Execution Environments (TEEs)
    • Enables CLH VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. process to run in non-root mode within the runtime-rs subsystem

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The env.shims, env.defaultShim, env.allowedHypervisorAnnotations, env.snapshotterHandlerMapping, env.pullTypeMapping, env.agentHttpsProxy, env.agentNoProxy, env._experimentalSetupSnapshotter, env._experimentalForceGuestPull (and their per-arch variants like *_x86_64), and env.debug fields are deprecated in the legacy format and will be removed in 2 releases.
25. 3.22.0 Oct 28, 2025 · release notes

    Adds experimental_force_guest_pull support, new TEE configs for runtime-rs (TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. QGS port=0, Dragonball seccomp), and nydus/erofs snapper selection in kata-deploy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.22.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.22.0

    • runtime-rs: add seccomp support for dragonball enables Seccomp filtering within the Dragonball VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely..
    • runtime: config: allow TDX QGS port=0 allows setting qemu.qgs_port to 0 in the configuration.
    • kata-deploy: Allow users to set experimental_force_guest_pull adds a helm chart option to force guest-side image pulling.
    • kata-deploy: Add the ability to set up different snapshotters (nydus & erofs) allows configuring the container runtime snapper in the deployment manifest.
    • runtime-go | kata-deploy: Add Arm CCA confidential Guest Support enables support for Arm Confidential Computing Architecture.

    5 details in Everything

26. advisory CVE-2025-58354 Sep 23, 2025 · issue 128
    • CVE-2025-58354: coco-tdx: malicious host can circumvent initdata verification (affects <=v0.15.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
27. 3.21.0 Sep 23, 2025 · release notes

    Kata Containers v3.21.0 adds initdata support for IBM SEL and Confidential Guests, new IO limits, and zstd packaging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.21.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.21.0

    • Adds initdata annotation support for remote configs in the Go runtime (runtime)
    • Adds initdata annotation support for NonProtection scenarios in the Rust runtime (runtime-rs)
    • Adds CoCo annotations support for ConfidentialGuests in qemu runtime
    • Adds zst suffix handling to kata-manager for tarball unpacking
    • Adds xz and zst suffix support for the kata tarball in kata-deploy local-build

    +2 more show less

    • Adds block devices io limit support in runtime-rs
    • Adds sandbox's shm volume support in runtime-rs

    7 details in Everything

28. 3.20.0 Aug 20, 2025 · release notes

    Kata Containers 3.20 adds seccomp support for Cloud Hypervisor and Firecracker runtimes, plus guest NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. components.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.20.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.20.0

    └──▷ USE IT
    Boot a pod VM directly using agent-ctl for debugging or validation without needing the full CRI stack.
    shell copy

    agent-ctl --vm

    • agent-ctl gains the --vm flag to boot a pod VM directly for testing purposes
    • runtime-rs adds seccomp syscall filtering for the Cloud Hypervisor runtime
    • runtime-rs adds seccomp syscall filtering for the Firecracker runtime
    • Guest-side NVIDIA GPU components are included for AMD64 workloads
    • kata-types removes the default setting of guest_hook_path from its configuration

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The annotation for passing through initdata confidential containers feature changed from io.katacontainers.config.runtime.cc_init_data to io.katacontainers.config.hypervisor.cc_init_data
29. 3.19.0 Jul 20, 2025 · release notes

    Kata Containers 3.19 adds runtime-rs blockfile rootfs, memory/vCPU hotplug for Cloud Hypervisor, vfio coldplug, and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.19.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.19.0

    • Adds blockfile based rootfs support in runtime-rs
    • Adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. support with coldplug for Cloud Hypervisor in runtime-rs
    • Adds GPU annotations for remote hypervisor in runtime-rs
    • Adds initdata annotation support for remote hypervisor in runtime-rs

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default block device driver is changed from virtio-scsi to virtio-blk-* in runtime-rs
    • !The Sev feature is deprecated and removed
30. 3.18.0 Jun 19, 2025 · release notes

    Kata Containers 3.18.0 adds TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. support in runtime-rs, shared_fs=none for CoCo, and forces guest image pulls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.18.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.18.0

    • Adds runtime: add option to force guest pull to allow pulling images inside the guest environment
    • Supports shared_fs = "none" for CoCo workloads in runtime-rs
    • Adds memory prealloc support for qemu/ch hypervisors in runtime-rs
    • Supports pulling images in guest using Kata Volumes for CoCo in runtime-rs

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hotplug_vfio_on_root_bus config key is removed from config.toml
31. 3.17.0 May 21, 2025 · release notes

    Kata Containers 3.17 adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP support, hot-plug block devices in qemu-rs, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Helm chart publishing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.17.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.17.0

    • Adds runtime/config VFIO configuration support for IBM SEL via VFIO config entries.
    • Enables hot-plug block device support in the Rust runtime (qemu-rs) using QMP commands.
    • Publishes helm charts to OCI registries for Kata Containers releases.
    • Adds RISC-V 64-bit architecture support for the kata-agent.
    • Adds EROFS Snapshotter Support to Kata containers for faster image processing.

    5 details in Everything

32. 3.16.0 Apr 25, 2025 · release notes

    Kata Containers 3.16 adds TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. QGS via Unix sockets, initdata for bare-metal/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and BUILD_TYPE=debug for genpolicy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.16.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.16.0

    └──▷ TRY IT
    Build genpolicy artifacts with debug symbols enabled.
    copy

    $ BUILD_TYPE=debug make genpolicy

    • BUILD_TYPE=debug in genpolicy to build debug policy binaries
    • TDX QGS support via Unix Domain Sockets in the runtime
    • initdata support for bare-metal and QEMU hypervisors
    • Default INSTALLATION_PREFIX validation in kata-deploy
    • Support for building the go, rust, or both runtimes

    5 details in Everything

33. 3.15.0 Mar 20, 2025 · release notes

    kata-containers 3.15.0 adds guest swap support, IOMMUFD GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. enhancements, and genpolicy sysctl/Route rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.15.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.15.0

    • Adds AddGuestSwap configuration option to confidential_guest.toml.in for enabling guest-side swap support
    • Adds UpdateRoutesRequest rules to genpolicy-settings allowing dynamic route updates inside the container policy
    • Adds UpdateInterfaceRequest rules to genpolicy-settings allowing dynamic interface updates inside the container policy
    • Enables IOMMUFD GPU support in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. via experimental updates and module signing
    • Adds genpolicy support for reading sysctls from PodSpec and environment defaults

    +3 more show less

    • Allows SNP_IDBlock configuration in runtime config to make Secure Nested Paging ID blocks adjustable
    • Enables Dragonball sandbox runtime exclusively on x86_64 and aarch64 architectures
    • Adds guest network route updates via new route flags support in the kernel agent

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dragonball sandbox runtime is now restricted to x86_64 and aarch64 architectures only; other platforms will not build or run with it
    • !s390x conditional compilation has been removed from runtime-rs, changing build targets for that architecture
34. 3.14.0 Feb 17, 2025 · release notes

    Kata Containers 3.14 adds sandbox API support, reclaim_guest_freed_memory config for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware./CHV, and VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP coldplug for s390x

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.14.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.14.0

    • Adds the sandbox API implementation allowing external management of Kata sandboxes
    • Adds reclaim_guest_freed_memory configuration option for both qemu and cloud-hypervisor hypervisors to allow host reclamation of freed guest memory
    • Enables VFIO-AP coldplug support for s390x architectures

    3 details in Everything

35. 3.13.0 Jan 16, 2025 · release notes

    Adds direct-volume auto-creation and mem-agent for improved resource isolation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.13.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.13.0

    • kata-ctl direct-volume now automatically creates the KATA_DIRECT_VOLUME_ROOT_PATH directory if it does not exist
    • Adds mem-agent support to kata-containers to enable memory-specific agent operations

    2 details in Everything

36. 3.12.0 Dec 18, 2024 · release notes

    Kata Containers 3.12.0 adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. builder images, kata-deploy multi-install support and containerd v3 config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.12.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.12.0

    • qemu runtime upgrades to QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. 9.1.2
    • kata-deploy gains multi-install support for multiple Kata installations on one host
    • kata-deploy supports containerd configuration version 3 via drop-in files

    3 details in Everything

37. 3.11.0 Nov 20, 2024 · release notes

    Adds CDI support in kata-agent and basic boilerplate for remote hypervisor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.11.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.11.0

    • kata-agent gains CDI support (pull #9584)
    • runtime-rs adds basic boilerplate for remote hypervisor (pull #10225)

    2 details in Everything

38. 3.10.0 Oct 22, 2024 · release notes

    Kata Containers 3.10 adds CDI device support, VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-DAN networking, virtio-scsi hotplugging, and confidential sealed secrets as volumes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.10.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.10.0

    • tools.kata-webhook now allows specifying the runtime class via a configMap
    • Introduces Container Device Interface (CDI) support in runtime-rs
    • Adds Dynamic Attached Network (DAN) support for VFIO network devices in the Go kata-runtime
    • Adds network device hotplugging capability to qemu-rs
    • Supports Confidential Sealed Secrets as a volume mount

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop of ACRN platform support by the acrn hypervisor component
39. 3.9.0 Sep 19, 2024 · release notes

    Kata Containers 3.9.0 adds CDH_API_TIMEOUT config, TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. mrconfigid settings, and image-rs xattr checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.9.0

    • agent/config introduces the CDH_API_TIMEOUT configuration key to control the Confidential Computing API timeout
    • runtime: Add support for setting mrconfigid, mrowner, and mrownerconfig in TDX configurations
    • image-rs (agent) now checks extended attributes (xattrs) during image unpacking for stricter security
    • virtcontainers allows specifying the nydus-overlayfs binary path via a configuration option

    4 details in Everything

40. 3.8.0 Aug 21, 2024 · release notes

    Adds kata-deploy Helm Chart, genpolicy support for cron jobs and envFrom, runtime-rs memory hotplugging, and trusted image storage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.8.0

    • genpolicy adds --version flag.
    • genpolicy gains support for the envFrom container spec field.
    • genpolicy gains support for Kubernetes CronJob resources.
    • genpolicy validates each exec command line argument (container.exec_commands).
    • initdata annotation can now be set in the hypervisor config.

    +3 more show less

    • kata-deploy provides a new Helm Chart for deployment.
    • runtime-rs adds wait_vm support for hypervisors.
    • Trusted image storage capability is introduced.

    8 details in Everything

41. 3.7.0 Jul 17, 2024 · release notes

    Kata Containers 3.7 adds Firecracker backend, CNCF Confidential Container Runtime policy support, and SharedFS for remote hypervisors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.7.0

    • Adds firecracker as a new hypervisor backend option in the runtime-rs agent
    • Enables pulling encrypted container images via standard OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry calls without external credential helpers
    • Introduces support for the CNCF Confidential Container Runtime (coco) policy framework in the Go kata-runtime via the DAN (Device Access Network) implementation
    • Implements SharedFS initialization for remote hypervisor configurations to allow shared volume mounts

    4 details in Everything

42. 3.6.0 Jun 17, 2024 · release notes

    Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. rootfs build targets, runtime QMP support for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and genpolicy runtimeClassName filter.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.6.0

    • Adds build targets for GPU rootfs initrd/image via gpu: Add build targets for GPU rootfs initrd/image
    • Adds QMP support for QEMU in runtime-rs (runtime-rs: add QMP support for Qemu(part I))
    • Adds genpolicy ability to filter by RuntimeClassName (new runtimeClassName filter in genpolicy)

    3 details in Everything

43. 3.5.0 May 15, 2024 · release notes

    Kata Containers 3.5.0 adds NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support for SNP/TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment., runtimeClasses, IOMMU in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and regorus policy engine

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0

    • Adds nvidia-gpu-snp.json and nvidia-gpu-tdx.json configuration files to the default distribution for confidential computing with NVIDIA GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference..
    • Integrates regorus as the new policy engine in kata-agent, replacing OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic..
    • Adds IOMMU support to QEMU VMs in runtime-rs via the QEMU command line.
    • Deploys default RuntimeClass resources for NVIDIA GPU workloads via kata-deploy.

    4 details in Everything

44. 3.4.0 Apr 19, 2024 · release notes

    Kata Containers 3.4.0 adds runtime-rs QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. support for s390x, Dragonball MTRR regs, and cgroups-v2 enablement via systemd.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0

    • qemu on s390x is now enabled in runtime-rs. Previously this architecture was not supported by the Rust runtime with QEMU.
    • Dragonballl: introduce MTRR regs support adds Memory Type Range Register handling to the Dragonball hypervisor component within the Kata agent/runtime stack.
    • kata-agent supports cgroups-v2 via systemd.unified_cgroup_hierarchy configuration, allowing modern container cgroup management inside the guest VM.

    3 details in Everything

45. 3.3.0 Mar 20, 2024 · release notes

    Kata Containers 3.3.0 adds StratoVirt support, vhost-net for Dragonball, and hypervisor annotation control in kata-deploy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0

    • Add StratoVirt as a supported lightweight VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. for Kata containers
    • Add vhost-net device support in the Dragonball sandbox runtime
    • Allow users to set hypervisor annotations via the ALLOWED_HYPERVISOR_ANNOTATIONS environment variable in kata-deploy
    • Include security details in the output of kata-runtime and kata-ctl commands
    • Add default configuration file for Cloud Hypervisor in runtime-rs

    5 details in Everything

46. 3.2.0 Oct 23, 2023 · release notes

    Kata Containers 3.2.0 adds CRI-O compatibility, TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. support for hypervisor annotations, and VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. configuration options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0

    • Adds hot_plug_vfio config entry to Cloud Hypervisor configuration to enable VFIO device binding.
    • Adds --xattr flag to virtiofsd invocations instead of -o xattr.
    • Allows specifying virtio_fs_extra_args annotation on containers to pass extra arguments to virtiofsd.
    • Adds support for CRI-O as a compatible container runtime in this release.

    4 details in Everything

47. 3.1.0 Mar 23, 2023 · release notes

    Kata Containers 3.1.0 adds AMD SEV-SNP support, hugepages, direct-volume ops via kata-ctl, and Darwin skeletons for macOS dev.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    • clh: Add hotplug support for network devices
    • virtcontainers: introduce hypervisor_darwin with Darwin skeletons for Linux subsystems to enable macOS development.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop QEMU log file support
48. 3.1.0-alpha1 Prerelease Dec 19, 2022 · release notes

    Kata Containers 3.1.0-alpha1 adds nydus snapshotter support, SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. guest agent support, and kata-ctl host checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0-alpha1 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0-alpha1

    └──▷ TRY IT
    Check if the installed kata-ctl binary matches the expected release version before deploying.
    copy

    $ kata-ctl check release --check-version-only

    Verify the host architecture compatibility for the running kata runtime using the new tool.
    copy

    $ kata-ctl check arch

    • Add nydus to release artifacts for use as an image snapshotter
    • Add kata-ctl CLI tool with architecture and version check capabilities (--check-version-only, arch checks)
    • Add SELinux support in the agent for guest containers (requires OSBuilder images and kernel configs)
    • Add Dragonball sandbox runtime support via new components

    4 details in Everything

49. 3.0.0 Oct 9, 2022 · release notes

    Kata Containers 3.0.0 adds Rust-based runtime, dragonball sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • support host cgroup v2 for the new Rust-based runtime implementation.
    • drop-in config files are now supported via the tomy::Value tree merging in runtime-rs.
    • GPU VFIO passthrough support enabled in the runtime.
    • FSGroup support added for the guest agent.
    • static resource management functionality available via config keys in runtime-rs.

    +2 more show less

    • inline-virtio-fs added as a shared_fs type in configuration.
    • disable_guest_seccomp functionality supported in runtime-rs.

    7 details in Everything

50. 2.5.1 Sep 2, 2022 · release notes

    kata-containers 2.5.1 adds hugetlb cgroup support via kernel CONFIG_CGROUP_HUGETLB and updates Cloud-Hypervisor to v26.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.1 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.5.1

    • Adds CONFIG_CGROUP_HUGETLB kernel option to the base image to enable hugetlb cgroups
    • Upgrades cloud-hypervisor runtime to version 26.0

    2 details in Everything

51. 2.5.0 Aug 17, 2022 · release notes

    kata-containers 2.5.0 adds kata-runtime iptables subcommand, containerd shimv2 logging support, and direct-assigned volumes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.5.0

    • kata-runtime iptables subcommand to get/set iptables rules in the guest via agent-ctl
    • Containerd shimv2 logging plugin support (shim: support shim v2 logging plugin)
    • Direct-assigned volume support (direct-assigned volumes)
    • Core scheduling support with containerd (core scheduling with containerd)

    4 details in Everything

52. 2.5.0-alpha2 Prerelease Jun 8, 2022 · release notes

    Kata Containers 2.5.0-alpha2 adds core-scheduling support, iptables get/set API, runk list subcommand, and Rust virtiofsd for non-x86_64.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.0-alpha2 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.5.0-alpha2

    • shim adds support for core scheduling
    • agent-ctl introduces handle for iptables get/set
    • runk supports the list sub-command

    3 details in Everything

53. 2.4.1 May 4, 2022 · release notes

    Kata Containers 2.4.1 adds fsGroup support for direct-assigned volumes and bumps hypervisors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.1 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.4.1

    • Adds fsGroup support for directly assigned volumes to allow POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. group ownership on mount

    1 detail in Everything

54. 2.4.0 Apr 1, 2022 · release notes

    Kata Containers 2.4.0 adds direct volume assignment, SGX/TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. support, static_sandbox_resource_mgmt flag, and agent CLI config option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.4.0

    • Add static_sandbox_resource_mgmt flag to enable static CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. management for better initial VM sizing when sandbox resource requirements are specified (requires containerd >= 1.6, Kubernetes >= 1.23)
    • Add new default configuration parameter announce_submounts to virtio-fs settings in the configuration file to prevent inode number collisions
    • Add support for Intel® Software Guard Extensions (Intel® SGX) as part of the default kernel with support added to Cloud Hypervisor and QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. drivers
    • Add initial Intel® Trust Domain Extensions (Intel® TDX) support for use with Cloud Hypervisor and QEMU
    • Add direct assigned volume support enabling volume managers like CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. to delegate block storage volume management to the kata agent

    +3 more show less

    • Make VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. configurable via a new configuration option
    • Add config file option to the kata-agent CLI for passing configuration directly via command line arguments
    • Update kata-monitor binary to listen on localhost by default and attach CRI metadata to metrics when available

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The netmon module is no longer supported and has been dropped from the runtime
55. 2.3.3 Mar 1, 2022 · release notes

    Kata Containers 2.3.3 adds configurable SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. for the VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. process and CRI-O shim event logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.3 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.3.3

    • Enables shim-v2 to log container lifecycle events for CRI-O compatibility.

    1 detail in Everything

56. 2.4.0-alpha2 Prerelease Feb 1, 2022 · release notes

    Merges govmm into kata-containers, adds SGX support to QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and enables initrd for Cloud Hypervisor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.0-alpha2 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.4.0-alpha2

    • Enables initrd boot capability for virtual machines using the Cloud Hypervisor backend.
    • Introduces static sandbox resource management in the runtime to control resource allocation.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The govmm package is no longer a separate dependency; it is merged directly into the kata-containers repository.
57. 2.3.0 Nov 29, 2021 · release notes

    Kata Containers 2.3.0 adds Seccomp support to the agent, VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. handling via vfio_mode annotation/config, and swap device support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.3.0

    └──▷ TRY IT
    Build a statically linked kata-agent without Seccomp to avoid static build failures.
    copy

    $ cd ./src/agent && make SECCOMP=no

    • Adds Seccomp filtering to the kata-agent (enabled by default in 2.3)
    • Introduces the vfio_mode config variable and annotation to control VFIO device handling for DPDK workloads
    • Adds support for swap devices within the guest OS

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Built configuration files moved from ./src/runtime/cli/config/ to ./src/runtime/config/
    • !Static builds of the agent are broken unless built with SECCOMP=no (cd ./src/agent && make SECCOMP=no)
58. 2.1.0 May 14, 2021 · release notes

    Kata Containers 2.1.0 adds the metrics subcommand to kata-runtime, introduces virtio-mem support, and enables sandbox-level bindmounts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.1.0

    • kata-runtime gains a new metrics command for gathering statistics on a running Kata sandbox
    • Adds virtio-mem support for dynamic memory management in the guest kernel (requires CONFIG_VIRTIO_MEM enabled)
    • kata-monitor can now export per-sandbox statistics

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ProcessListContainer/ListProcesses APIs are removed from the runtime API
59. 2.0.4 May 13, 2021 · release notes

    Kata Containers 2.0.4 upgrades to Cloud Hypervisor v15 and supports Kubernetes 1.21

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.4 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.0.4

    • Upgrades the default hypervisor to Cloud Hypervisor v15.0
    • Adds compatibility with Kubernetes 1.21.0-00

    2 details in Everything

60. 2.0.3 Apr 9, 2021 · release notes

    Kata Containers 2.0.3 adds pod overhead calculation to runtime class configs and updates agent-ctl.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.3 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.0.3

    • kata-deploy now automatically includes pod overhead in the generated runtime class configurations.

    1 detail in Everything

61. 2.0.0 Oct 19, 2020 · release notes

    Kata Containers 2.0 introduces kata-monitor and agent-ctl, rewires the agent to rust with ttRPC, defaults virtio-fs, and drops kata-shim/proxy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.0 https://github.com/kata-containers/kata-containers.git
    # already have the repo? check out this version:
    $ git checkout 2.0.0

    └──▷ TRY IT
    Validate the guest agent's state and capabilities using the new CLI tool.
    copy

    $ agent-ctl GetGuestDetails

    • kata-monitor component introduced to improve observability and manageability for the runtime
    • agent-ctl tool introduced (with GetGuestDetails subcommand) to validate the agent API
    • Agent protocol switched from gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. to ttRPC, simplifying the agent wire format
    • Kata-agent rewritten in rust to reduce memory overhead and overall attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources.
    • virtio-fs set as the default shared file system type (via --thread-pool-size=1 passed to virtiofsd), replacing virtio-9p for better POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. compliance

    +1 more show less

    • kata-shim and kata-proxy components removed; runtime now moves to support solely shimv2 API

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !kata-shim and kata-proxy are no longer required and are removed from the release; existing deployments relying on these binaries will fail to start unless migrated to the shimv2-only architecture
    • !The default shared file system has changed to virtio-fs; environments relying on virtio-9p behavior must explicitly configure an alternative or accept POSIX compliance differences