{"slug": "kata-containers", "name": "Kata Containers", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "", "recommenders": 1, "commenters": 3, "warners": 1, "score": 0.147, "rising": -0.33, "first": "2026-02-16", "latest": "2026-10-05", "why": "I use Kata Containers on Kubernetes (Firecrackers)", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 1, "compare": 0, "warn": 1}, "spark": [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I use Kata Containers on Kubernetes (Firecrackers)", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["Kata Containers"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 755121697, "item_id": 47195106, "url": "https://news.ycombinator.com/item?id=47195106", "by": "buremba", "date": "2026-02-28", "stance": "recommend", "quote": "use proper VMs like Kata Containers and Firecrackers. Not just Docker containers in production.", "excerpt": "My take is that agents should only take actions that you can recover from by default. You can gradually give it more permission and build guardrails such as extra LLM auditing, time boxed whitelisted domains etc. That's what I'm experimenting with https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with you. 2. Use incremental snapshots an", "context": "", "use_case": "isolating agents in production", "switched_from": "", "story": "Don't trust AI agents"}, {"id": 754508050, "item_id": 47156753, "url": "https://news.ycombinator.com/item?id=47156753", "by": "buremba", "date": "2026-02-25", "stance": "recommend", "quote": "use proper VMs like Kata Containers and Firecrackers.", "excerpt": "Sandboxes are not enough but you can have more observability into what the agent is doing, only give it access to read-only data and let it take irreversible actions that you can recover from. Here are some tips from building sandboxed multi-tenant version of Openclaw, my startup: https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with yo", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Sandboxes won't save you from OpenClaw"}, {"id": 752686592, "item_id": 47042912, "url": "https://news.ycombinator.com/item?id=47042912", "by": "buremba", "date": "2026-02-16", "stance": "recommend", "quote": "I use Kata Containers on Kubernetes (Firecrackers)", "excerpt": "Neat! I wasn\u2019t aware that Docker has an embedded microVM option. I use Kata Containers on Kubernetes (Firecrackers) and restrict network access with a proxy that supports you to block/allow domain access. Also swap secrets at runtime so agents don\u2019t see any secrets (similar to Deno sandboxes) If anybody is interested in running agents ok K8S, here is my shameless plug: https://github.com/lobu-ai/lobu", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Running NanoClaw in a Docker Shell Sandbox"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 799520834, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "warn", "quote": "Kata is HARD to make.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "production cluster isolation", "switched_from": "Kata Containers", "story": "Linux containers in 500 lines of code (2016)"}]}], "who": [{"by": "cpburns2009", "context": "evaluating sandboxing against supply chain attacks", "url": "https://news.ycombinator.com/item?id=48490080", "date": "2026-06-11"}], "tags": [], "use_cases": ["agent sandboxing", "production cluster isolation", "sandboxing containers", "isolating agents in production"], "compared": [{"slug": "firecracker", "name": "Firecracker", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "docker", "name": "Docker", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "openclaw", "name": "OpenClaw", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49965118", "title": "Linux containers in 500 lines of code (2016)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48489485", "title": "Are we defaulting to VM-level sandboxing before understanding the threat model?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47194611", "title": "Don't trust AI agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47154803", "title": "Sandboxes won't save you from OpenClaw", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47041456", "title": "Running NanoClaw in a Docker Shell Sandbox", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"warn": 1}}, "quotes": [{"id": 799520834, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "warn", "quote": "Kata is HARD to make.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "production cluster isolation", "switched_from": "Kata Containers", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 775841280, "item_id": 48490080, "url": "https://news.ycombinator.com/item?id=48490080", "by": "cpburns2009", "date": "2026-06-11", "stance": "neutral", "quote": "Backend for containerd to run each container in a KVM-backed QEMU microVM", "excerpt": "This is what I've been working on the past month: a strategy for running sandboxed containers. It's not strictly for agents (I'm now using it for OpenCode). You should be thinking about supply chain attacks for all of your applications that use third-party dependencies. PyPI and NPM have had a lot of compromised packages recently. The litellm hack affected a lot of agents, and there have been some Docker escape explo", "context": "evaluating sandboxing against supply chain attacks", "use_case": "sandboxing containers", "switched_from": "", "story": "Are we defaulting to VM-level sandboxing before understanding the threat model?"}, {"id": 755121697, "item_id": 47195106, "url": "https://news.ycombinator.com/item?id=47195106", "by": "buremba", "date": "2026-02-28", "stance": "recommend", "quote": "use proper VMs like Kata Containers and Firecrackers. Not just Docker containers in production.", "excerpt": "My take is that agents should only take actions that you can recover from by default. You can gradually give it more permission and build guardrails such as extra LLM auditing, time boxed whitelisted domains etc. That's what I'm experimenting with https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with you. 2. Use incremental snapshots an", "context": "", "use_case": "isolating agents in production", "switched_from": "", "story": "Don't trust AI agents"}, {"id": 754508050, "item_id": 47156753, "url": "https://news.ycombinator.com/item?id=47156753", "by": "buremba", "date": "2026-02-25", "stance": "recommend", "quote": "use proper VMs like Kata Containers and Firecrackers.", "excerpt": "Sandboxes are not enough but you can have more observability into what the agent is doing, only give it access to read-only data and let it take irreversible actions that you can recover from. Here are some tips from building sandboxed multi-tenant version of Openclaw, my startup: https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with yo", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Sandboxes won't save you from OpenClaw"}, {"id": 752686592, "item_id": 47042912, "url": "https://news.ycombinator.com/item?id=47042912", "by": "buremba", "date": "2026-02-16", "stance": "recommend", "quote": "I use Kata Containers on Kubernetes (Firecrackers)", "excerpt": "Neat! I wasn\u2019t aware that Docker has an embedded microVM option. I use Kata Containers on Kubernetes (Firecrackers) and restrict network access with a proxy that supports you to block/allow domain access. Also swap secrets at runtime so agents don\u2019t see any secrets (similar to Deno sandboxes) If anybody is interested in running agents ok K8S, here is my shameless plug: https://github.com/lobu-ai/lobu", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Running NanoClaw in a Docker Shell Sandbox"}]}