User-defined Playground

Kata Containers Demo Playground

Ivan Velichko
by  Ivan Velichko
on
KubernetesSecurity

A Kubernetes cluster with the Kata Containers runtime preinstalled.

Startup configuration
dev-machine
cplane-01
node-01
node-02
Kata Containers Demo playground: A Kubernetes cluster with the Kata Containers runtime preinstalled.

This playground demonstrates the Nested Virtualization capabilities of the new Cloud Hypervisor backend. It is based on the official Kubernetes Omni playground and adds the following simple customizations:

  1. Backends of the cplane-01, node-01, and node-02 machines were switched from the default Firecracker to Cloud Hypervisor.
  2. Kata Containers installed using its official Helm chart.
  3. A QEMU-backend Nginx Pod is deployed.
export VERSION=$(curl -sSL https://api.github.com/repos/kata-containers/kata-containers/releases/latest | jq .tag_name | tr -d '"')
export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy"

helm install kata-deploy "${CHART}" --version "${VERSION}"

kubectl apply -f -<<EOF
apiVersion: v1
kind: Pod
metadata:
  name: nginx-kata-qemu
spec:
  runtimeClassName: kata-qemu
  containers:
    - name: nginx
      image: nginx:stable
EOF

To verify that the Nginx process runs in its own VM, you can use the following command:

kubectl exec -it nginx-kata-qemu -- uname -a

Linux nginx-kata-qemu 6.18.15 #1 SMP Tue Mar 17 01:39:00 UTC 2026 x86_64 Linux

To see the full list of the supported runtime classes, run:

kubectl get runtimeclasses

NAME                            HANDLER                         AGE
kata-clh                        kata-clh                        33s
kata-cloud-hypervisor           kata-cloud-hypervisor           33s
kata-dragonball                 kata-dragonball                 33s
kata-fc                         kata-fc                         33s
kata-qemu                       kata-qemu                       33s
kata-qemu-cca                   kata-qemu-cca                   33s
kata-qemu-coco-dev              kata-qemu-coco-dev              33s
kata-qemu-coco-dev-runtime-rs   kata-qemu-coco-dev-runtime-rs   33s
kata-qemu-nvidia-gpu            kata-qemu-nvidia-gpu            33s
kata-qemu-nvidia-gpu-snp        kata-qemu-nvidia-gpu-snp        33s
kata-qemu-nvidia-gpu-tdx        kata-qemu-nvidia-gpu-tdx        33s
kata-qemu-runtime-rs            kata-qemu-runtime-rs            33s
kata-qemu-se                    kata-qemu-se                    33s
kata-qemu-se-runtime-rs         kata-qemu-se-runtime-rs         33s
kata-qemu-snp                   kata-qemu-snp                   33s
kata-qemu-snp-runtime-rs        kata-qemu-snp-runtime-rs        33s
kata-qemu-tdx                   kata-qemu-tdx                   33s
kata-qemu-tdx-runtime-rs        kata-qemu-tdx-runtime-rs        33s
Every playground includes

A real VM, not a container

Get root on a VM with its own kernel, so Docker, Kubernetes, and systemd just work.

Read the docs →

SSH from browser or CLI

Use the built-in web terminal, or connect with labctl ssh, plain ssh, scp, or rsync.

Read the docs →

Drive it with AI

Let Claude, Codex, or any MCP client start this playground and run commands in it.

Read the docs →

Expose HTTP(S) ports

Give any web app running inside the VM a public URL - for yourself or to share with others.

Read the docs →

Share terminals

Invite others into your terminal session, or open it yourself from another device.

Read the docs →

Customize with init scripts

Add shell scripts that run at boot to install packages, clone repos, or seed test data.

Read the docs →

Private networking

VMs reach the internet via NAT with no public IP; several VMs share bridge networks.

Read the docs →

Ephemeral or persistent

By default, VMs are destroyed when the session ends; enable persistence to keep the disks for next time.

Read the docs →

Built-in container registry

A private registry.iximiuz.com for every playground to share images across services and VMs.

Read the docs →

Learn more about playgrounds
Start
Settings