Katakate
Infrastructure
self-hosted vm orchestration
SHOW HN2025
How HN took it
3 positive, 6 neutral or asking, 1 mixed, 5 critical, out of 15 comments about the project. Thread score -0.03.
Idea: 1 for, 2 againstPrivacy: 0 for, 2 againstExecution: 1 for, 0 againstDesign: 0 for, 1 againstPricing: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Strong isolation via hardware virtualization and clean Python/K8s design
From 3 comments
as someone in the space this ticks a lot of boxes: kubernetes-native, strong isolation, python sdk (ideal for ML scenarios). devmapper is a nice ootb approach. Glancing at the…
alexeldeib on HNGreat project. There's been multiple approaches/tools in the space(top of my head I can think of e2b, arrakis, claude's new tool). how is this different?
Bnjoroge on HNThanks! I'll review Arrakis and come back. E2B is often considered harder to setup and less AI engineers friendly for direct stack contributions, as Katakate is the only…
gbxk on HN
Maker responsive to security feedback, fixed DNS exfiltration default
From 2 comments
> One thing I could do is make it exposed in config, to allow the user to block all DNS resolutions until Cilium is integrated. LMK if desired! Yes, but it's not great for it to…
srcreigh on HNTest passed, PR merged
gbxk on HN
Objections
No business model; maker worried about future rug-pull
From 1 comment
> No business model short-term. My goal is broad adoption, 100% open-source. IMHO that's kind of a red flag. There's a happy path here where it's successful but stays…
yjftsjthsd-h on HN
Default DNS allowance enables data exfiltration
From 2 comments
``` name: project-build image: alpine:latest namespace: default egress_whitelist: - "1.1.1.1/32" # Cloudflare DNS - "8.8.8.8/32" # Google DNS ``` This is basically a wide-open…
srcreigh on HN> One thing I could do is make it exposed in config, to allow the user to block all DNS resolutions until Cilium is integrated. LMK if desired! Yes, but it's not great for it to…
srcreigh on HN
Only works on Linux with KVM, not cloud or Mac ARM initially
From 1 comment
(sorry I didn't reply in-thread, I'm new to HN, re-posting response here:) Exactly! The main local requirement is to have hardware virtualization available (e.g. /dev/kvm) but…
gbxk on HN
Requests
Kubernetes CRD or native API support instead of CLI
From 1 comment
This seems like an amazing stack that ticks a lot of boxes for me, but I really dislike cli or a custom api as the UX for this and would prefer to manage all of this with CRDs so…
empath75 on HN
Local-first sandboxing support
From 1 comment
I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding models / agentic…
mentalgear on HN
TEE or side-channel protection
From 2 comments
Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network…
elric on HNThat's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.
gbxk on HN
Questions
How is it different from E2B, Arrakis, or gVisor
From 2 comments
Great project. There's been multiple approaches/tools in the space(top of my head I can think of e2b, arrakis, claude's new tool). how is this different?
Bnjoroge on HNLooks like an interesting project. Do you have any comments on how it is different from running gVisor?
re_spond on HN
Does it run on cloud VMs with nested virtualization
From 1 comment
There are some providers that offer KVM nested virtualization, I think Google Cloud, Digital Ocean ... any others?
ofrzeta on HN
Alternatives named
E2B
From 2 comments
Great project. There's been multiple approaches/tools in the space(top of my head I can think of e2b, arrakis, claude's new tool). how is this different?
Bnjoroge on HNIs this basically an open-source DIY version of E2B? If so, cool! AFAICT E2B is open-source licensed but tricky to setup.
bigwheels on HN
gVisor
From 1 comment
Looks like an interesting project. Do you have any comments on how it is different from running gVisor?
re_spond on HN
Apple containers
From 1 comment
What about this: https://github.com/apple/container
_false on HN
Anthropic sandbox-runtime
From 1 comment
Anthropic recently released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime I…
dloss on HN