Release notes of Sandboxed-Container

• A project quota is supported to limit the number of bytes that can be written to the container rootfs directory.
• A disk can be mounted to a sandboxed container.
• An Apsara File Storage NAS (NAS) file system can be mounted to a sandboxed container.
• Custom kernel parameters are supported for sandboxed pods.
• Quality of Service (QoS) policies and network traffic marking policies are supported.

• Sandboxed-Container V2.0 is a container runtime developed by Alibaba Cloud on top of lightweight virtual machines. This version supports more lightweight and efficient deployment, and simplifies the architecture and maintenance of Kubernetes clusters.
• Reduces the resource overheads by 90% and accelerates the startup of sandboxed containers by three times.
• Increases the deployment density of standalone sandboxed containers by 10 times.
• The virtio-fs file system is supported. The performance of this file system is higher than the performance of the 9pfs file system.

• The security risk that is related to the container-storaged component is eliminated.
• The issue where the kubectl cp command is blocked after you run this command is fixed.
• The issue where logs cannot be printed to stdout files after containerd is restarted is fixed.
• The issue where the system time of sandboxed containers may not be synchronized at regular intervals is fixed.

• Alibaba Cloud disks and NAS file systems can be mounted to sandboxed containers. This provides the same performance as the volumes that are mounted to the host and avoids performance loss when storage devices are mounted over 9pfs.
• RootFS block I/O throttling is supported.

The stability of Sandboxed-Container V1.1.0 is significantly improved.

• Strong isolation based on sandboxed and lightweight virtual machines.
• Compatibility with runC in terms of application management.
• High performance that is equivalent to 90% of the performance provided by applications based on runC.
• The same user experience as runC in terms of logging, monitoring, and storage.
• The RuntimeClass feature is released. This feature allows you to select container runtimes such as runC and runV. For more information, see RuntimeClass.
• Ease of use with minimum technical skill requirements.
• Higher stability compared with the open source Kata Containers runtime. For more information about Kata Containers, see Kata Containers.