Hacker News Reader

The instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.

I'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?

Any untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that

In GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.

Yes except slow io

Can you elaborate? What type of I/O, network, disk? What is the issue exactly?

You can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls

Thanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?

It does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think