Skip to main content
Katakate (k7) lets you run secure VM sandboxes on Kubernetes — Firecracker, QEMU + Longhorn, or k7d. This Quickstart gets you from zero to a working sandbox via CLI and Python SDK.
If you already installed k7 previously, consider running make uninstall before reinstalling to avoid stale cached files in a previous .deb.

Requirements

  • Linux (amd64) host with hardware virtualization (KVM)
    • Check: ls /dev/kvm should exist
    • Cloud guidance: AWS .metal, GCP (enable nested virtualization), Azure D/Ev series; typical VPS often lack KVM
  • One raw, unformatted disk for thin‑pool provisioning (recommended for many sandboxes)
  • Docker with Compose plugin (for the API)
    • Install Docker: curl -fsSL https://get.docker.com | sh
  • Ansible for the installer (Ubuntu):
  • Python 3.10+ on the client for the SDK
Tested setup example: Hetzner Robot instance, Ubuntu 24.04 (x86_64), with an extra empty NVMe disk (for the thin‑pool). See the detailed setup guide (PDF): k7_hetzner_node_setup.pdf.

Install the CLI (APT)

Install the k7 CLI on the node(s) that will host the VM sandboxes:

Install K7 on your node(s)

This installs and wires up Kubernetes (K3s), Kata, Firecracker, Jailer, and the devmapper snapshotter with thin‑pool provisioning:
Example output: k7 install
You should see “Installation completed successfully!” when done. Add -v for verbose output.

The API and managing keys

k7 install deploys the K7 API automatically as a k7-api Deployment in kube-system. K3s keeps it running and reschedules it on failure — there’s no separate “start” step. If you want a CLI-only install with no API deployed, pass --no-api to k7 install.

Check API status

Get the endpoint

Generate an API key

Example: k7 generate-api-key

Temporarily disable / re-enable the API

  • API keys are stored at /etc/k7/api_keys.json on the cluster node. Authentication accepts the X-API-Key header or Authorization: Bearer <token>.
  • The previous top-level commands k7 start-api / k7 stop-api / k7 api-status / k7 get-api-endpoint are deprecated; they still work for one release and emit a deprecation warning pointing at the new home.

Create your first sandbox via CLI

Example k7.yaml:

Create a sandbox

Example: k7 create

Shell into your sandbox

Example: k7 shell

List sandboxes

Example: k7 list

Delete a sandbox

Delete all sandboxes

Prerequisites for the SDK

Create your first sandbox via Python SDK

Install the SDK on your client machine:
Use the synchronous client:
Async variant:

Next steps

  • Explore the CLI guide: /guides/cli
  • Explore the Python SDK guide: /guides/python-sdk
  • Integrate with the REST API: /api/introduction