Kata images

• Comparing Rootfs images with initrd images
• Why images use an init daemon
• systemd as the image init daemon
  • pros
  • cons

This page provides information on Kata Containers "mini O/S" images.

Comparing Rootfs images with initrd images

Comparison of running Kata with a image= entry with running Kata with an initrd= entry in the configuration.toml configuration file.

Feature	systemd-specific	Available in image	Available in initrd	Notes
Agent log messages with use_vsock=true	yes	yes	no	Uses kata-journald-host-redirect.service.
Debug console	yes	yes	no
Guest time sync	yes	yes	no	Uses chrony.
Static tracing	yes	yes	no	Currently relies on kata-agent.service to shutdown VM.
Start agent	"yes" but easy to change	yes	yes	kata-agent is the init daemon in an initrd image.

Why images use an init daemon

• Ability to manage services.
• Allows users to add additional services to custom images.

systemd as the image init daemon

pros

• De facto Linux init daemon.
• Avoids having to "re-invent the wheel" by implementing additional functionality in the agent - just drop in a standard service.
• Automatically handles mounting standard mounts (/dev, etc).
• Leverage systemd boot time performance improvements from Clear Linux.
• Allows underlying osbuilder distro to be changed with minimal impact on the environment.

cons

• Large binary - bloats image.
• Large potential attack surface.