Usernetes is a tool for deploying Kubernetes clusters without requiring root privileges on the host, mitigating potential container-breakout vulnerabilities. It supports two deployment modes: Kubernetes-in-Docker (using rootless container engines like Docker, Podman, or nerdctl) and Kubernetes-in-Kubernetes (running as UserNS-enabled pods in an existing Kubernetes cluster). The architecture is modular, consisting of a container image packaging Kubernetes components, Docker Compose/Kubernetes manifests for orchestration, a Makefile for management tasks, and helper scripts for initialization and networking. Key features include automatic subnet assignment based on hostname hashes, container engine detection, and seamless integration with kubeadm for cluster bootstrap.
Kata Containers is an open-source secure container runtime that runs each container inside a lightweight virtual machine (microVM), providing strong workload isolation while maintaining container-like performance and orchestration. The project provides a containerd shim-v2 implementation, a guest-side agent, and supports multiple hypervisors including QEMU, Cloud Hypervisor, Firecracker, and its own built-in VMM (Dragonball). It integrates deeply with Kubernetes (runtime classes, CSI, mutating webhooks, policy generation via Rego) and supports confidential computing features (TDX, SEV-SNP, IBM Secure Execution, ARM CCA). The codebase is dual-language: the primary runtime is written in Go, with a newer Rust rewrite (runtime-rs) that shares core libraries with the agent and Dragonball VMM. The project is actively maintained with extensive CI, multi-architecture support, and a large ecosystem of tools (agent-ctl, kata-ctl, log-parser, trace-forwarder, genpolicy). While the architecture is modular and many components (e.g., safe-path, dbs-allocator, retry library) are independently reusable, the coexistence of two runtime implementations, generated API clients, and architecture-specific code introduce some technical drift and maintenance overhead.