<p>As I understand,
<a href="https://github.com/kata-containers/kata-containers" rel="noreferrer">Kata Containers</a></p>

<blockquote>
  <p>Kata Container build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers but provide the workload isolation and security advantages of VMs</p>
</blockquote>

<p>On the other hand, <a href="https://github.com/google/gvisor" rel="noreferrer">gvisor</a></p>

<blockquote>
  <p>gVisor is a user-space kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects.  </p>
</blockquote>

<p>As I believe, both of these technology trying to add <strong>linux space</strong> into containers in order to enhance security.</p>

<p>My question is How do they differ from each other ? Is there overlapping in functionalities?</p>

Suresh Vishnoi
<p>From what I gather:</p>
<p>Kata Containers</p>
<ul>
<li>Full Kernel on top of a lightweight QEMU/KVM VM
<ul>
<li>Kernel has been optimized in newer releases.</li>
</ul>
</li>
<li>Lets system calls go through freely</li>
<li>Performance penalty due to the VM layer. Not clear yet how slower or faster than gVisor</li>
<li>On paper, slower startup time.</li>
<li>Can run any application.</li>
<li>Can run in nested virtualized environments if the hypervisor and hardware support it.</li>
</ul>
<p>gVisor</p>
<ul>
<li>Partial Kernel in userspace.</li>
<li>Intercepts syscalls</li>
<li>Performance penalty at runtime due to syscall filtering. Not clear how slower or faster than Kata yet.</li>
<li>On paper, faster startup time.</li>
<li>Can run only applications that use supported system calls.</li>
<li>On paper, you may not need nested virtualization.</li>
</ul>
