Kata Containers 4.0 Cements the Project's Role as the Open Source Standard for Sandboxing AI Agents
A new Rust-based default runtime, expanded hardware support and a hardened supply chain give the project's isolation model the strength agentic workloads demand
AUSTIN, Texas, July 22, 2026 /PRNewswire/ -- The Kata Containers community today announced the release of Kata Containers 4.0, a milestone that reinforces the project's growing role as the open source foundation for sandboxing AI agents. The release's central engineering achievement, a new Rust-based runtime, becomes the project's default implementation, delivering the memory safety and performance gains needed to isolate agents whose behavior can't always be predicted in advance.
Kata Containers is an open source project that combines the speed of Linux containers with the isolation of lightweight virtual machines. The project is managed by the OpenInfra Foundation and is used across multi-tenant Kubernetes environments, secure CI/CD pipelines and, increasingly, AI infrastructure.
*** Download Kata Containers 4.0
Why AI Agents Need a Stronger Sandbox
AI agents carry a different risk profile than traditional microservices: their execution paths shift based on the tools they can reach, the memory they accumulate and the prompts they receive, making them harder to trust by default. Kata Containers addresses that risk by running each workload inside its own lightweight virtual machine rather than sharing the host kernel, so a compromised agent cannot see another agent's memory or move laterally across a cluster.
Kata Containers now serves as one of the supported runtimes for Agent Sandbox, a project under the Kubernetes SIG Apps umbrella, and remains the foundation for Confidential Containers, which encrypts data in use, allowing agent workloads to process private data without exposing it to the infrastructure operator.
*** Community experts from Ant Group, Google and NVIDIA discussed these use cases in depth during the OpenInfra Live episode on agent sandboxing, summarized in this Superuser article.
Organizations already running agent workloads in production are taking notice.
"Ant Group has long been a pioneer in deploying Kata Containers at scale. We first proved its value in co-locating our offline batch and compute workloads, where latency is less critical, to maximize resource efficiency and advance Ant Group's green computing initiatives. To further bolster our security posture, we expanded Kata's footprint to our core online services last year, enabling real-time security auditing and immediate mitigation of malicious access. Today, Kata has naturally become the foundational secure sandbox for our AI Agents. With its outstanding isolation and ultra-fast startup performance, Kata is now an integral part of Ant Group's Agentic Infrastructure. The architectural leap in Kata 4.0—especially the transition to the Rust runtime—directly addresses the stringent security and efficiency requirements of modern AI sandboxing. This release is a masterpiece of community collaboration, and we are proud to drive its adoption." — Fupan Li, Kata Containers architecture committee (AC) member and head of container technology, Ant Group
"Kata Containers 4.0 brings a memory-safe Rust foundation to one of the ecosystem's most proven sandboxing frameworks. NVIDIA's full GPU support, carried seamlessly from the Go runtime to Rust, enables customers to adopt 4.0 without disruption — running agentic AI and confidential workloads with stronger isolation, attestation, and performance. The NVIDIA Confidential Containers Reference Architecture, built on Kata Containers, provides NVIDIA partners a validated Confidential Computing framework for Kubernetes deployments, accelerating the path from evaluation to production. NVIDIA is proud to support this milestone and remains committed to helping customers deploy confidential AI at scale." — Erik Bohnhorst, director of product management, NVIDIA
"Kata Containers is the foundation of our confidential computing stack here at Edgeless. Our Contrast framework shields entire fleets of containers within Kubernetes and our end-to-end encrypted GenAI inference service Privatemode AI builds directly on top of that. Kata's pod-in-VM model is what makes this possible. The project's continued focus on confidential computing has been essential to us. We're excited about the 4.0 release and proud to contribute to a project that so many production workloads now depend on." — Felix Schuster, CEO, Edgeless Systems
"Kata is a key component for many of Microsoft's container isolation workloads such as AKS's pod sandboxing offering. Kata's focus on confidentiality, rust-based security, and improved agentic isolation continue to make it a valuable tool to meet the demands of our customers. Microsoft is proud to contribute to this Kata release, and to continue improving the security of AI workloads for our customers." Jim Perrin — principal program manager lead - Azure Linux, Microsoft
A Rust-Based Foundation Makes It Possible
That level of isolation is only possible because of the architectural work behind Kata Containers 4.0. With this release, runtime-rs, the Rust-based runtime, replaces the original Go implementation as the project's default, capping a multi-year community effort to move onto a memory-safe foundation. The change improves memory safety, reduces the runtime's footprint and lowers startup latency, the kind of performance headroom that matters when sandboxes are being spun up and torn down at agent speed. The Go runtime is now deprecated and will continue to receive bug and security fixes during a defined transition period, but the community will not remove it before Kata Containers 5.0.
"Kata Containers 4.0 marks an important evolution for the project," said Ildiko Vancsa, director of community for the OpenInfra Foundation. "By making the Rust runtime the default, the community is strengthening the project's safety guarantees while creating a foundation for long-term innovation in secure cloud-native infrastructure."
*** For the full technical breakdown, including the Go runtime deprecation timeline, supported hypervisors and hardware architectures, read the Kata Containers 4.0 release notes.
Version 4.0 also brings changes beyond the runtime: formalized release acceptance criteria, expanded hardware and hypervisor support, and a hardened software supply chain with updated dependencies and stricter CI checks. Together, these changes give the project a clearer, more predictable foundation for future releases.
*** For a closer look at the community's work on the new Rust-based runtime, read the Kata Containers 4.0 blog post.
Get Involved
Kata Containers is an open source community that welcomes contributors across runtime development, documentation, testing and ecosystem integration.
About Kata Containers
Kata Containers is an open source project that delivers the performance of standard Linux containers with the enhanced isolation of lightweight virtual machines. Built for secure multi-tenant environments, Kata Containers enables cloud-native workloads to run with stronger isolation without sacrificing speed or compatibility. Kata Containers is managed by the OpenInfra Foundation. katacontainers.io
About the OpenInfra Foundation
The OpenInfra Foundation builds communities that write open source infrastructure software running in production. Backed by more than 110,000 individuals in 187 countries, the OpenInfra Foundation hosts open source projects and communities of practice covering AI infrastructure, container-native applications, edge computing and datacenter clouds. The OpenInfra Foundation is part of the nonprofit Linux Foundation. Join the OpenInfra movement: www.openinfra.org
Media Contacts:
Robert Cathey
Cathey.co for the OpenInfra Foundation
[email protected]
Allison Price
OpenInfra Foundation
[email protected]
SOURCE OpenInfra Foundation
Share this article