Engineering notes on tempus.build: runners, isolation, supply chain, and the economics of CI.https://tempus.build/enhttps://tempus.build/en/blog/kata-containers-4-runtime-rs/https://tempus.build/en/blog/kata-containers-4-runtime-rs/In 4.0 the default Kata runtime becomes runtime-rs, in Rust instead of Go. What changes inside: how runtime-rs is built, what memory safety buys a host-side runtime, the new block storage model, and a verified rootfs via dm-verity/EROFS.Tue, 28 Jul 2026 00:00:00 GMThttps://tempus.build/en/blog/kata-containers-isolation/https://tempus.build/en/blog/kata-containers-isolation/Ordinary containers share the host kernel. Kata Containers runs each pod in a lightweight VM with its own guest kernel — OCI-compatible, under containerd. A look at the Kata 3.x architecture and why it's the right boundary for untrusted CI code.Mon, 27 Jul 2026 00:00:00 GMT