Sandbox Runtime Setup
K8E auto-detects installed runtimes and registers the corresponding RuntimeClass. Choose based on your isolation requirements:
| Runtime | Isolation | Requirement | Boot time |
|---|---|---|---|
| gVisor | Syscall interception (userspace kernel) | None | ~10ms |
| Kata Containers | VM-backed (QEMU) | Nested virt or bare metal | ~500ms |
| Firecracker | Hardware microVM (KVM) | /dev/kvm | ~125ms |
gVisor — Recommended Default
# Official "Latest release" bundle: https://gvisor.dev/docs/user_guide/install/#latest-release
# Since the 2026-07 multi-file layout, bare runsc binaries are no longer published.
ARCH=$(uname -m) # x86_64 on most servers, aarch64 on ARM
URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}
wget ${URL}/gvisor.tar.zstd ${URL}/gvisor.tar.zstd.sha512
sha512sum -c gvisor.tar.zstd.sha512 # must print OK
sudo tar --zstd -xf gvisor.tar.zstd -C /usr/local/bin
ls -l /usr/local/bin/runsc /usr/local/bin/containerd-shim-runsc-v1 /usr/local/bin/gvisor-bin # verify installed
No
zstdon the host? The same directory shipsgvisor.tar.bz2— usesudo tar -xjf gvisor.tar.bz2 -C /usr/local/bininstead.
The bundle contains
runsc, thecontainerd-shim-runsc-v1shim and agvisor-bin/directory of sidecar binaries thatrunscresolves next to its own binary. Extract the whole bundle and keep the files together — do not relocaterunscalone.
Do not run
runsc install— K8E manages its own containerd config at/var/lib/k8e/agent/etc/containerd/config.tomland auto-injects the gVisor stanza on startup.
Kata Containers
bash -c "$(curl -fsSL https://raw.githubusercontent.com/kata-containers/kata-containers/main/utils/kata-manager.sh) install-packages"
kata-runtime check
Firecracker (requires /dev/kvm)
ls /dev/kvm # verify KVM is available
# Install firecracker-containerd shim + devmapper snapshotter
# See: https://github.com/firecracker-microvm/firecracker-containerd
mkdir -p /var/lib/firecracker-containerd/runtime
# Place hello-vmlinux.bin and default-rootfs.img here
Apply Changes
Install runtimes before starting K8E for zero-restart setup. If K8E is already running, restart it after installing a new runtime shim:
systemctl restart k8e
kubectl get runtimeclass
# NAME HANDLER AGE
# gvisor runsc 10s
# kata kata-qemu 10s
# firecracker firecracker 10s ← only if /dev/kvm present
