{"id":19809546,"url":"https://github.com/didier-durand/microk8s-kata-containers","last_synced_at":"2025-08-09T23:38:57.089Z","repository":{"id":40361447,"uuid":"309037307","full_name":"didier-durand/microk8s-kata-containers","owner":"didier-durand","description":"Kata Containers with MicroK8s","archived":false,"fork":false,"pushed_at":"2024-07-25T09:51:31.000Z","size":782,"stargazers_count":34,"open_issues_count":16,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-07-25T11:17:06.183Z","etag":null,"topics":["containerd","docker","gce","google-cloud","kata-containers","kata-runtime","kubernetes","microk8s","oci","podman","runc"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/didier-durand.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-11-01T06:29:48.000Z","updated_at":"2024-07-25T11:17:06.184Z","dependencies_parsed_at":"2024-06-21T18:54:24.115Z","dependency_job_id":"1d4d30a5-f57b-4ebe-8044-3c47ac8d8390","html_url":"https://github.com/didier-durand/microk8s-kata-containers","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didier-durand%2Fmicrok8s-kata-containers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didier-durand%2Fmicrok8s-kata-containers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didier-durand%2Fmicrok8s-kata-containers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didier-durand%2Fmicrok8s-kata-containers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/didier-durand","download_url":"https://codeload.github.com/didier-durand/microk8s-kata-containers/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224245667,"owners_count":17279649,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["containerd","docker","gce","google-cloud","kata-containers","kata-runtime","kubernetes","microk8s","oci","podman","runc"],"created_at":"2024-11-12T09:17:19.104Z","updated_at":"2024-11-12T09:17:19.714Z","avatar_url":"https://github.com/didier-durand.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n\u003cimg src=\"img/kata-logo.png\" height=\"125\"\u003e\u003cimg src=\"img/microk8s-logo.png\" height=\"125\"\u003e \u003cimg src=\"img/podman-logo.jpg\" height=\"125\"\u003e\u003cimg src=\"img/oci-logo.png\" height=\"125\"\u003e\u003cimg src=\"img/containerd-logo.png\" height=\"125\"\u003e\n\n# Kata Containers on MicroK8s\n\n![workflow badge](https://github.com/didier-durand/microk8s-kata-containers/workflows/Kata%20Containers%20on%20MicroK8s/badge.svg)\n![workflow badge](https://github.com/didier-durand/microk8s-kata-containers/workflows/MicroK8s%20Services%20Images/badge.svg)\n\u003cimg src=\"https://img.shields.io/badge/kubernetes-1.19-blue\"\u003e\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\n* [Goal](README.md#goal)\n* [Kata Containers - Rationale](README.md#kata-containers---rationale)\n* [Specific Setup](README.md#specific-setup)\n* [Workflow Steps](README.md#workflow-steps)\n* [How to Fork \u0026 Run](README.md#how-to-fork--run)\n* [Execution Report](README.md#execution-report)\n\n\n## Goal\n\n[**Nota Bene:** This repository is **Work In Progress (WIP)**: currently, we abruptly replace *\"[runc](https://github.com/opencontainers/runc)\"* binary, initially packaged with MicroK8s, with a symbolic link (symlink) to *\"[kata-runtime](https://github.com/kata-containers/runtime)\"*  binary, installed on the Ubuntu instance from project's GitHub repository and added to the MicroK8s [snap](https://en.wikipedia.org/wiki/Snap_(package_manager)) in early steps of this workflow. This initial (very) direct shortcut is possible because both binaries fully respect the [OCI runtime specification](https://opencontainers.org/). Next version of this repo will properly adapt the configuration of [containerd](https://containerd.io/) (via changes in containerd.toml) and implement the K8s [RuntimeClass](https://kubernetes.io/docs/concepts/containers/runtime-class/) to be able to dynamically choose the runtime on per container basis: proper directives in Deployment yaml manifests will allow simultaneous use of *\"runc\"* and *\"kata-runtime\"* in parallel by different containers having different execution requirements.]\n\nThis repository encompasses a fully scripted Github workflow (via [microk8s-kata.yml](.github/workflows/microk8s-kata.yml) calling [microk8s-kata.sh](sh/microk8s-kata.sh)) to test the transparent use of the runtime for Kata Containers (Katas) on MicroK8s. It must run on a quite specific Google Cloud Engine (GCE) instance since so-called *\"[nested virtualization](https://pve.proxmox.com/wiki/Nested_Virtualization)\"* is required by Katas when running on the cloud due to its embedded virtual machine coming on top of the cloud hypervisor managing the Linux host. Some sample containerized services (see [helloworld.go](src/go/helloworld/helloworld.go) and [autoscale.go](src/go/autoscale/autoscale.go) built automatically with this [side job](.github/workflows/build-docker-images.yml)) are deployed from Docker Hub and executed as Kubernetes services on MicroK8s.\n\nThe workflow tests the proper execution of sample containers with 'kata-runtime' after running them initially on standard 'runc' to validate global setup: beyond run of traditional helloworld-go, autoscale-go is called with parameters ensuring that thorough computations and resource allocation are properly executed by the replacing runtime.\n\n[MicroK8s](https://microk8s.io/) by Canonical was chosen on purpose for this project: its source code is extremely close to the upstream version of Kubernetes. Consequently, it allows to build a fully-featured production-grade Kubernetes cluster that can be run autonomously - on a single Limux instance - with very sensible default configuration allowing a quick setup, quite representative of a productive system.\n\nTo automatically confirm the validity of this workflow overtime when new versions of the various components (Kata Containers, MicroK8s, Podman, Ubuntu, etc.) get published, cron schedules it on a recurring basis: execution logs can be seen in [Actions tab](https://github.com/didier-durand/microk8s-kata-containers/actions). Excerpts of last execution are gathered [further down in this page](README.md#execution-report).\n\n**Forking and re-using on your own is strongly encouraged!** All comments for improvements and extensions will be welcome. Finally, if you like this repo, please give a Github star so that it gets more easily found by others.\n\n## Kata Containers - Rationale\n\nAs per [Katas' website](https://katacontainers.io/): *\"Kata Containers is an open source community working to build a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide stronger workload isolation using hardware virtualization technology as a second layer of defense.\"*\n\nThis added lightweight virtual machine comes with a dedicated Linux kernel, providing isolation of network, I/O and memory and utilizes hardware-enforced isolation through Intel's [VT-x features](https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtualization_(VT-x)) for virtualization. \n\n\u003cimg src=\"img/kata-vs-docker.jpg\" height=\"500\"\u003e\n\nThe use of a per-container dedicated kernel and lightweight virtual machines, provided by either [Qemu](https://www.qemu.org/) or [Amazon's Firecracker](https://firecracker-microvm.github.io/), creates a much stronger isolation between the containers themselves and with the host. For example, if a container misbehaves and messes up with the kernel resources by overconsuming or corrupting them, it's only **HIS** dedicated kernel that gets damaged, not the unique kernel shared between all containers and host, as when you're using regular containers. The picture above shows the clear differences between the two architectures. So, Kata Containers are probably the best option currently available for additional security and reliability with untrusted workloads of all kinds (recent versions, external source code, etc.). \n\nAs you would expect, this further level of isolation through additional virtualization comes with a performance / cost penalty but this [comparative study](https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-assets-prod/presentation-media/kata-containers-and-gvisor-a-quantitave-comparison.pdf) between the performances of raw host performances, *\"runc\"*, [Google's gVisor](https://gvisor.dev/) containers and Kata Containers demonstrates that the overhead remains quite acceptable in many situations for the additional security that is delivered. Look at slides 19 to 26 of the linked pdf to get the exact numbers.\n\n## Specific Setup\n\nVarious specific points have to be part of this workflow:\n\n1. [Katas on GCE](https://github.com/kata-containers/documentation/blob/master/install/gce-installation-guide.md) implies use of [nested virtualization](https://en.wikipedia.org/wiki/Virtualization#Nested_virtualization): this requires to create a [specific GCE image](https://cloud.google.com/compute/docs/instances/enable-nested-virtualization-vm-instances) to activate the [Intel VT-x instruction set](https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtualization_(VT-x)). This is obtained by the addition of a specific option *\"--licenses=\"* to the command *\"gcloud compute images create\"*. See [microk8s-kata.sh](sh/microk8s-kata.sh) for details.\n\n2. The underlying hardware must minimally be of the Intel's [Broadwell architecture generation](https://en.wikipedia.org/wiki/Broadwell_(microarchitecture)) to provide the VT-x instructions. This is guaranteed by adding *\"--min-cpu-platform 'Intel Broadwell'\"* to the command *\"gcloud compute instances create\"*. See [microk8s-kata.sh](sh/microk8s-kata.sh) for details.\n\n3. [Podman CLI](https://podman.io/) is used instead of Docker CLI because Docker is not compatible with Kata Containers runtime 2.0. As [this article](https://developers.redhat.com/blog/2019/02/21/podman-and-buildah-for-docker-users/) explains it, the transition from Docker to Podman is very easy: command syntax and results are extremely close and even identical in most cases.\n\n## Workflow Steps\n\nThe major steps in this workflow are: \n\n1. Check that GCE instance is proper ('GenuineIntel') - according to the above requirement for Broadwell - via lscpu after it has been created.\n2. Install Kata Containers runtime directly from the Github repository of the project.\n3. Check that this added runtime can run on the instance: command *\"kata-runtime kata-check\"* MUST produce output *\"System is capable of running Kata Containers\"*\n4. Install Podman and check via *\"podman info\"* that it sees both its standard runtime *\"runc\"* and the newly added *\"kata-runtime\"*\n5. Run the latest version of [Alpine Linux](https://en.wikipedia.org/wiki/Alpine_Linux) image with selection of kata-runtime (*\"--runtime='kata-runtime\"*) and verify through *\"podman inspect\"* that the running Alpine is effectively using kata-runtime.\n6. Install MicroK8s via snap and check that it works properly via the deployment of [helloworld-go.yml](kubernetes/helloworld-go.yml) and [autoscale-go.yml](kubernetes/autoscale-go.yml) service manifests, built from from GoLang source code in [src/go directory](src/go). Stop MicroK8s when validation is successful.\n7. Open the MicroK8s .snap file to add kata-runtime and repackage a new version (now unsigned) of the .snap file. Please, note use of *\"unsquashfs\"* and *\"mksquashfs\"* to achieve this refurbishing since the [snap archive format](https://en.wikipedia.org/wiki/Snap_(package_manager)) is based on read-only and compressed [SquashFS](https://en.wikipedia.org/wiki/SquashFS) Linux file system.\n8. Remove old MicroK8s installation and re-install a fresh instance based with newly created snap version: *\"--dangerous\"* option is now required since the tweaked .snap is no longer signed by its official provider, Canonical.\n9. Deploy again helloworld-go and autoscale-go on fresh MicroK8s to validate that they work fine with kata-runtime: autoscale-go request is parametrized to make sure that some amount computing resources are consumed to achieve a better validation.\n\n## How to Fork \u0026 Run\n\nTo start with, you need a Google Cloud account including a project where the GCE APIs have been enabled. Obtain the id of your project from \nGCP dashboard. Additionally, you need to create in this project a service account (SA) and give it proper GCE credentials: right to create, administer and delete GCE images \u0026 instances (if your cannot  make the SA a \"Project Owner\" to simplify the security aspects...). Save the private key of the SA in json format.\n\nThen, fork our repository and define the required [Github Secrets](https://docs.github.com/en/actions/reference/encrypted-secrets) in your fork: \n\n1. your GCP project id will be {{ secrets.GCP_PROJECT }}\n2. The private key of your service account in json format will be ${{ secrets.GCP_SA_KEY }} \n\nTo easily use the workflow from Github, you can launch it with the [manual dispatch feature of Github](https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/) that you can see as a launch button (the green one in the picture below) in the Action tab of your fork.\n\n\u003cimg src=\"img/microk8s-kata-launch-button.jpg\" height=\"250\"\u003e\n\nThe workflow will execute all the steps described above and terminate gracefully after all validation tests described are completed: it will then delete the GCE instance and the associated image triggering the nested virtualization.\n\nIf you also want to make use of the [side workflow](.github/workflows/build-docker-images.yml) allowing to build the test container images from their GoLang sources, you'll need to add 2 additional secrets : {{ secrets.DOCKER_USERID }} \u0026 {{ secrets.DOCKER_PASSWORD }} corresponding to the login parameters of your [Docker Hub account](https://hub.docker.com/).\n\n## Execution Report\n\nBelow are some relevant excerpts of the last execution log:\n\n\n\n```\n### execution date: Sat Nov 28 09:49:46 UTC 2020\n \n### microk8s snap version:\nmicrok8s          v1.19.3     1791   1.19/stable      canonical*         classic\n \n### ubuntu version:\nDistributor ID:\tUbuntu\nDescription:\tUbuntu 20.04.1 LTS\nRelease:\t20.04\nCodename:\tfocal\n \n### docker version:\nClient: Docker Engine - Community\n Version:           19.03.13\n API version:       1.40\n Go version:        go1.13.15\n Git commit:        4484c46d9d\n Built:             Wed Sep 16 17:02:52 2020\n OS/Arch:           linux/amd64\n Experimental:      false\n \n### kata-runtime version:\nkata-runtime  : 1.12.0-rc0\n   commit   : \u003c\u003cunknown\u003e\u003e\n   OCI specs: 1.0.1-dev\n \n### kata-runtime check:\nSystem is capable of running Kata Containers\n \n\n### check existing container runtimes on Ubuntu host:\n-rwxr-xr-x 1 root root 9.7M Sep  9 15:40 /bin/runc\n-rwxr-xr-x 1 root root 31M Oct 22 16:51 /bin/kata-runtime\n\n### check active OCI runtime: \n\n### test use of kata-runtime with alpine: \nCONTAINER ID  IMAGE                            COMMAND  CREATED        STATUS                     PORTS   NAMES\n7d90229b5af6  docker.io/library/alpine:latest  sh       2 seconds ago  Up Less than a second ago          kata-alpine\n        \"Name\": \"kata-alpine\",\n        \"Id\": \"7d90229b5af691afd78a472d10e7948b9d5a6d9756065cdf7be88463b3f9733b\",\n        \"OCIRuntime\": \"kata-runtime\",\n\n### install microk8s:\nmicrok8s is running\nhigh-availability: no\n  datastore master nodes: 127.0.0.1:19001\n  datastore standby nodes: none\naddons:\n  enabled:\n    ha-cluster           # Configure high availability on the current node\n  disabled:\n    ambassador           # Ambassador API Gateway and Ingress\n    cilium               # SDN, fast with full network policy\n    dashboard            # The Kubernetes dashboard\n    dns                  # CoreDNS\n    fluentd              # Elasticsearch-Fluentd-Kibana logging and monitoring\n    gpu                  # Automatic enablement of Nvidia CUDA\n    helm                 # Helm 2 - the package manager for Kubernetes\n    helm3                # Helm 3 - Kubernetes package manager\n    host-access          # Allow Pods connecting to Host services smoothly\n    ingress              # Ingress controller for external access\n    istio                # Core Istio service mesh services\n    jaeger               # Kubernetes Jaeger operator with its simple config\n    knative              # The Knative framework on Kubernetes.\n    kubeflow             # Kubeflow for easy ML deployments\n    linkerd              # Linkerd is a service mesh for Kubernetes and other frameworks\n    metallb              # Loadbalancer for your Kubernetes cluster\n    metrics-server       # K8s Metrics Server for API access to service metrics\n    multus               # Multus CNI enables attaching multiple network interfaces to pods\n    prometheus           # Prometheus operator for monitoring and logging\n    rbac                 # Role-Based Access Control for authorisation\n    registry             # Private image registry exposed on localhost:32000\n    storage              # Storage class; allocates storage from host directory\n\n### check container runtime on microk8s snap:\n-rwxr-xr-x 1 root root 15M Nov  6 12:06 /snap/microk8s/current/bin/runc\n\n### TEST WITH RUNC\n\n\n### test microk8s with helloworld-go \u0026 autoscale-go: \nservice/helloworld-go created\ndeployment.apps/helloworld-go-deployment created\nservice/autoscale-go created\ndeployment.apps/autoscale-go-deployment created\nNAME                                       READY   STATUS              RESTARTS   AGE\nnginx-test                                 0/1     ContainerCreating   0          1s\nhelloworld-go-deployment-86f5466d4-dc5d6   0/1     ContainerCreating   0          0s\nhelloworld-go-deployment-86f5466d4-5wfd9   0/1     ContainerCreating   0          0s\nautoscale-go-deployment-5894658957-4vl42   0/1     Pending             0          0s\nautoscale-go-deployment-5894658957-6747m   0/1     ContainerCreating   0          0s\n\nwaiting for ready pods...\n\nNAME                                       READY   STATUS    RESTARTS   AGE\nnginx-test                                 1/1     Running   0          2m2s\nautoscale-go-deployment-5894658957-4vl42   1/1     Running   0          2m1s\nhelloworld-go-deployment-86f5466d4-5wfd9   1/1     Running   0          2m1s\nhelloworld-go-deployment-86f5466d4-dc5d6   1/1     Running   0          2m1s\nautoscale-go-deployment-5894658957-6747m   1/1     Running   0          2m1s\nNAME            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE\nkubernetes      ClusterIP   10.152.183.1     \u003cnone\u003e        443/TCP        2m34s\nhelloworld-go   NodePort    10.152.183.42    \u003cnone\u003e        80:31982/TCP   2m2s\nautoscale-go    NodePort    10.152.183.245   \u003cnone\u003e        80:31469/TCP   2m1s\n\ncalling helloworld-go...\n\nHello World: Kata Containers!\n\ncalling autoscale-go with request for biggest prime under 10 000 and 5 MB memory...\n\nAllocated 5 Mb of memory.\nThe largest prime less than 10000 is 9973.\nSlept for 100.18 milliseconds.\n\n### re-install microk8s incl kata-runtime: \nmicrok8s v1.19.3 installed\nmicrok8s is running\nhigh-availability: no\n  datastore master nodes: 127.0.0.1:19001\n  datastore standby nodes: none\naddons:\n  enabled:\n    ha-cluster           # Configure high availability on the current node\n  disabled:\n    ambassador           # Ambassador API Gateway and Ingress\n    cilium               # SDN, fast with full network policy\n    dashboard            # The Kubernetes dashboard\n    dns                  # CoreDNS\n    fluentd              # Elasticsearch-Fluentd-Kibana logging and monitoring\n    gpu                  # Automatic enablement of Nvidia CUDA\n    helm                 # Helm 2 - the package manager for Kubernetes\n    helm3                # Helm 3 - Kubernetes package manager\n    host-access          # Allow Pods connecting to Host services smoothly\n    ingress              # Ingress controller for external access\n    istio                # Core Istio service mesh services\n    jaeger               # Kubernetes Jaeger operator with its simple config\n    knative              # The Knative framework on Kubernetes.\n    kubeflow             # Kubeflow for easy ML deployments\n    linkerd              # Linkerd is a service mesh for Kubernetes and other frameworks\n    metallb              # Loadbalancer for your Kubernetes cluster\n    metrics-server       # K8s Metrics Server for API access to service metrics\n    multus               # Multus CNI enables attaching multiple network interfaces to pods\n    prometheus           # Prometheus operator for monitoring and logging\n    rbac                 # Role-Based Access Control for authorisation\n    registry             # Private image registry exposed on localhost:32000\n    storage              # Storage class; allocates storage from host directory\n\n### TEST WITH KATA-RUNTIME\n\n\n### test microk8s with helloworld-go \u0026 autoscale-go: \nservice/helloworld-go created\ndeployment.apps/helloworld-go-deployment created\nservice/autoscale-go created\ndeployment.apps/autoscale-go-deployment created\nNAME                                       READY   STATUS              RESTARTS   AGE\nnginx-test                                 0/1     ContainerCreating   0          2s\nhelloworld-go-deployment-86f5466d4-hzmv8   0/1     ContainerCreating   0          1s\nautoscale-go-deployment-5894658957-m5qff   0/1     ContainerCreating   0          0s\nhelloworld-go-deployment-86f5466d4-vntqb   0/1     ContainerCreating   0          1s\nautoscale-go-deployment-5894658957-ckc2z   0/1     ContainerCreating   0          0s\n\nwaiting for ready pods...\n\nNAME                                       READY   STATUS    RESTARTS   AGE\nnginx-test                                 1/1     Running   0          2m3s\nautoscale-go-deployment-5894658957-m5qff   1/1     Running   0          2m1s\nhelloworld-go-deployment-86f5466d4-hzmv8   1/1     Running   0          2m2s\nhelloworld-go-deployment-86f5466d4-vntqb   1/1     Running   0          2m2s\nautoscale-go-deployment-5894658957-ckc2z   1/1     Running   0          2m1s\nNAME            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE\nkubernetes      ClusterIP   10.152.183.1     \u003cnone\u003e        443/TCP        2m26s\nhelloworld-go   NodePort    10.152.183.67    \u003cnone\u003e        80:32503/TCP   2m2s\nautoscale-go    NodePort    10.152.183.112   \u003cnone\u003e        80:30065/TCP   2m1s\n\ncalling helloworld-go...\n\nHello World: Kata Containers!\n\ncalling autoscale-go with request for biggest prime under 10 000 and 5 MB memory...\n\nAllocated 5 Mb of memory.\nThe largest prime less than 10000 is 9973.\nSlept for 100.65 milliseconds.\n\n### check proper symlink from microk8s runc:\nlrwxrwxrwx 1 root root 30 Nov 28 09:43 /snap/microk8s/current/bin/runc -\u003e squashfs-root/bin/kata-runtime\n-rwxr-xr-x 1 root root 31560112 Oct 22 16:51 /bin/kata-runtime\n-rwxr-xr-x 1 root root 31560112 Nov 28 09:43 /snap/microk8s/current/bin/kata-runtime\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidier-durand%2Fmicrok8s-kata-containers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdidier-durand%2Fmicrok8s-kata-containers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidier-durand%2Fmicrok8s-kata-containers/lists"}