---
name: "kata-containers-qemu-isolation"
description: "Run containers inside dedicated lightweight hardware microVMs with QEMU or Cloud Hypervisor."
metadata:
  author: "Kata Containers"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "install kata containers"
  - "configure kata microvm containerd"
  - "setup kata runtimeclass"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Kata Containers Hardware-Assisted MicroVM Isolation

Deploys Kata Containers: configuring QEMU / Cloud-Hypervisor backends, virtio-fs file system sharing, Kubernetes containerd-shim-v2 integration, and running high-security workloads with true VM isolation.

## When to Invoke
Invoke this skill whenever you need to:
- install kata containers
- configure kata microvm containerd
- setup kata runtimeclass

## Execution SOP & Rules
1. Verify hardware nested virtualization: egrep -c '(vmx|svm)' /proc/cpuinfo must be > 0.
2. Install kata-containers packages and configure /etc/kata-containers/configuration.toml.
3. Register containerd runtime shim: 'io.containerd.kata.v2' in containerd config.
4. Deploy pods with runtimeClassName: kata-qemu or kata-clh to execute inside dedicated microVMs.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.