Kata Containers Files

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version. However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-6f787300c-5106e7b34-1.91-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-4c760fd03-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-e02e22643-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-b2c943931-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.25.8-rust-1.91-5c0269881-x86_64
• tools: quay.io/kata-containers/builders:tools-d366d103c-169f92ff0-169f92ff0-f6e0a7c33-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-2962e14c1-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• Add sev-snp, qemu-snp as required CI by @hgowda-amd in https://github.com/kata-containers/kata-containers/pull/12543
• versions: Update Cloud Hypervisor to v50.0 by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12536
• gpu: HGX Bx00 kernel enablement by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12551
• tests: enable more scenarios for k8s-guest-pull-image.bats by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12461
• ci: lower the load on AKS by @fidencio in https://github.com/kata-containers/kata-containers/pull/12529
• tests: Enable auto-generated policies for experimental_force_guest_pull by @fidencio in https://github.com/kata-containers/kata-containers/pull/12563
• runtime-rs: Support for block device hotplug on s390x by @BbolroC in https://github.com/kata-containers/kata-containers/pull/12531
• tests: enable policy for openvpn on nydus by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12545
• tests: Improve assertion handling for runtime-rs hypervisor by @BbolroC in https://github.com/kata-containers/kata-containers/pull/12569
• build(deps): bump github.com/BurntSushi/toml from 1.3.2 to 1.5.0 in /src/runtime by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/11365
• Prep for go 1.25 switch by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12562
• kata-deploy: a few guard-rails to avoid failures if components are not set in the values.yaml file by @fidencio in https://github.com/kata-containers/kata-containers/pull/12559
• tests: Extend fail timeout for failure test by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12566
• runtime-rs: Enhance Qemu/SNP Protection by @Apokleos in https://github.com/kata-containers/kata-containers/pull/12400
• versions: bump Trustee to latest version by @fitzthum in https://github.com/kata-containers/kata-containers/pull/12572
• workflows: Swap our go install for setup-go by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12575
• build(deps): bump keccak from 0.1.5 to 0.1.6 in /src/tools/agent-ctl by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/12553
• versions: update cloud hypervisor to v51.1 by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12565
• Try and remove unused crates by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12564
• kata-deploy: allow to configure kubectl image by @sathieu in https://github.com/kata-containers/kata-containers/pull/12574
• runtime: Support memory hotplug via virtio-mem on s390x by @BbolroC in https://github.com/kata-containers/kata-containers/pull/12573
• agent-genpolicy: read bundle-id from OCI spec rootfs by @fidencio in https://github.com/kata-containers/kata-containers/pull/12586
• workflow: Recommended improvements by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12477
• workflow: Update actionlint workflows by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12584
• kata-deploy: Fix nydus snapshotter config (on v3 config version) by @fidencio in https://github.com/kata-containers/kata-containers/pull/12577
• qemu: Remove PCIe root port BAR reserve sizing by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12507
• send the task create/start/delete event to containerd by @lifupan in https://github.com/kata-containers/kata-containers/pull/12513
• runtimes: add configurable kubelet root dir by @fidencio in https://github.com/kata-containers/kata-containers/pull/12587
• docs: Use more accurate wording for /dev hostPath behavior by @sprt in https://github.com/kata-containers/kata-containers/pull/12608
• workflow | tests: Remove install go by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12596
• versions: Bump go to 1.25.7 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12502
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.35.0 to 1.40.0 in /src/runtime by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/12609
• docs: require explicit User/Group/AdditionalID by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12578
• gha: pass the arch for setup-go on ppc64le by @Amulyam24 in https://github.com/kata-containers/kata-containers/pull/12616
• tests: Expand auto generated policy tests by @fidencio in https://github.com/kata-containers/kata-containers/pull/12610
• build: kernel: Do not expect a modules tarball for vanilla kernel by @fidencio in https://github.com/kata-containers/kata-containers/pull/12550
• gatekeeper: Add EditorConfig checker to required tests by @sprt in https://github.com/kata-containers/kata-containers/pull/12619
• ci: Remove SNP tests from required by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12627
• Tooling bump x/net to v0.51.0 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12613
• versions: bump to Linux v6.18.15 (LTS) by @mythi in https://github.com/kata-containers/kata-containers/pull/12611
• runtime: Skip to call sandboxDevices() for remote hypervisor by @BbolroC in https://github.com/kata-containers/kata-containers/pull/12617
• kata-deploy: a bunch of fixes regarding uninstall, rke2 and k3s tests by @fidencio in https://github.com/kata-containers/kata-containers/pull/12626
• tests: k8s: basic test for subPathExpr by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12615
• k8s-policy-pvc: use local PV/PVC when no default StorageClass exists by @fidencio in https://github.com/kata-containers/kata-containers/pull/12555
• genpolicy: settings.d drop-ins and scenario example drop-ins by @fidencio in https://github.com/kata-containers/kata-containers/pull/12542
• kata-deploy: add per-shim configurable pod overhead by @zachspar in https://github.com/kata-containers/kata-containers/pull/12630
• kernel: include mmio fragment in unified build for firecracker by @fidencio in https://github.com/kata-containers/kata-containers/pull/12591
• nvidia: Bump nvidia-container-toolkit to 1.18.1 by @fidencio in https://github.com/kata-containers/kata-containers/pull/12265
• agent-ctl: Update aws-lc-rs by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12628
• ci: keep mktemp output suffix stable with .yaml by @Apokleos in https://github.com/kata-containers/kata-containers/pull/12631
• runtime-rs: Fix dragonball's flaky unit tests by @Apokleos in https://github.com/kata-containers/kata-containers/pull/12623
• coco: Implement trusted ephemeral data storage by @sprt in https://github.com/kata-containers/kata-containers/pull/10559
• versions: bump golang to 1.25.8 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12643
• genpolicy: add to Cargo workspace by @burgerdev in https://github.com/kata-containers/kata-containers/pull/12640
• nvidia: fix invalid CTK reference by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12646
• build(deps): bump quinn-proto from 0.11.8 to 0.11.14 in /src/tools/agent-ctl by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/12653
• workflows: Bump OSV scanner by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12517
• doc: Release model update by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12343
• versions: bump trustee to latest version by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12648
• tests: nvidia: call genpolicy auth for all tests by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12664
• runtime: bump go.mod version by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12661
• nvidia-gpu: add missing libraries to rootfs by @jojimt in https://github.com/kata-containers/kata-containers/pull/12535
• runtime: make CDI annotation vendor-agnostic with lookup table by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12556
• kernel: Ship System.map as part of the kernel build by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12607
• agent: cdh: Update CDH and its API along with sealed secret tests by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12459
• release: Bump version to 3.28.0 by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12668
• ci: Stop building/deploying CSI driver by @sprt in https://github.com/kata-containers/kata-containers/pull/12650
• gpu: Obsolete the NVIDIA initrd build by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12669

New Contributors

• @hgowda-amd made their first contribution in https://github.com/kata-containers/kata-containers/pull/12543
• @sathieu made their first contribution in https://github.com/kata-containers/kata-containers/pull/12574
• @zachspar made their first contribution in https://github.com/kata-containers/kata-containers/pull/12630

Full Changelog: https://github.com/kata-containers/kata-containers/compare/3.27.0...3.28.0