Awesome GitHub RepositoriesContainer Engines

Firecracker is a virtual machine monitor that leverages hardware-assisted virtualization to create and manage isolated execution environments. It functions as a lightweight runtime designed to launch virtual machines with minimal memory overhead and near-instantaneous startup times, providing the security of traditional hardware virtualization with the efficiency of containerized workloads. The project distinguishes itself through a security-focused architecture that enforces strict process boundaries using system-level barriers and restricted user privileges. It minimizes the attack surface

Libpod is a container management library for running and controlling the lifecycle of Open Container Initiative compliant containers and images across different storage backends. It provides a programmatic interface for the remote control and automation of container environments. The project enables the coordination of multiple containers into pods that share network namespaces and other shared resources. It supports rootless container execution by using user namespaces to launch containers without administrative privileges. The library covers a broad range of system operations, including im

runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container Initiative specification. It serves as a low-level container execution engine that interfaces directly with the host operating system to manage the lifecycle of isolated processes. The tool functions as a Linux process containerizer, utilizing kernel features such as namespaces for process isolation and control groups for resource governance. It enforces security by restricting processes to specific directory trees and dropping unnecessary kernel privileges to minimize the attac

Bocker is a minimal container management tool written in Bash that implements core container functionality using Linux namespaces and control groups. It serves as a Linux container manager capable of starting and managing isolated processes and images through low-level kernel features. The project includes an OCI image tool for pulling, saving, and building container images compatible with industry standards. It further integrates a cgroup resource controller to restrict CPU and memory consumption for isolated processes. The tool covers the full container lifecycle, including process isolati

rkt is a secure Linux container engine and pod-native container manager. It provides a composable execution environment for launching and managing isolated application containers on Linux, serving as a runtime designed around open industry standards for image formats and networking interfaces. The system is distinguished by a pod-native execution model that groups multiple containers and shared resources into single, self-contained units. It utilizes pluggable execution engines to provide secure isolation, including the use of hardware-based virtualization to create security boundaries betwee

Podman Desktop is a graphical user interface for managing container images, pods, and volumes across multiple container engines and Kubernetes clusters. It serves as a container engine orchestrator for installing, configuring, and updating engines, as well as a deployment dashboard for connecting to Kubernetes environments and switching cluster contexts. The application is an extensible developer tool that utilizes a plugin system to allow users to add new features and orchestration capabilities through third-party modules. The tool provides a resource dashboard for local container managemen

Podman Desktop is a graphical user interface for building, managing, and deploying containers and Kubernetes clusters from a local workstation. It serves as a container engine manager and a Kubernetes cluster dashboard, providing a visual environment for tasks typically handled via the command line. The project includes a container extension framework that allows users to integrate additional tools and capabilities into the management environment through a plugin system and extension catalog. The software covers the full container lifecycle, including image building and pushing to registries

Youki هو وقت تشغيل حاوية OCI مكتوب بلغة Rust. ينفذ مواصفات وقت تشغيل مبادرة الحاوية المفتوحة (OCI) لإدارة دورة حياة العمليات الحاوية وضمان التوافق مع صور ومحركات الحاويات القياسية. تم تصميم وقت التشغيل لسلامة الذاكرة ويدعم تنفيذ الحاوية بدون جذر (Rootless)، مما يسمح للحاويات بالعمل كمستخدمين غير جذريين لتقليل مخاطر الأمان والحد من تصعيد الامتيازات. يوفر قدرات أساسية لإدارة الحاويات، بما في ذلك إنشاء وإدارة حاويات OCI. يتم تحقيق ذلك من خلال عزل مساحة اسم Linux، وتحديد الموارد القائم على cgroup، وتعيين مساحة اسم المستخدم لتقسيم العمليات عن نظام التشغيل المضيف.

LXC هو إطار عمل افتراضي على مستوى نظام التشغيل ومدير حاويات Linux يستخدم لتشغيل أنظمة Linux معزولة متعددة على مضيف واحد. يعمل كمنسق لمساحات أسماء النواة ووقت تشغيل حاوية غير مميز، مما يسمح بإنشاء وإدارة حاويات النظام دون تكاليف إضافية للمراقب (hypervisor). يوفر المشروع تنفيذ حاوية غير مميز عن طريق تعيين مستخدمي جذر الحاوية لمستخدمي مضيف غير مميزين لمنع الوصول إلى نظام المضيف. يضمن الأمان من خلال تصفية استدعاءات النظام وعزل مستخدم الجذر، مما يمكن الحاويات من العمل دون الحاجة إلى امتيازات جذر المضيف. يدير إطار العمل عزل الموارد باستخدام مجموعات التحكم (cgroups) لتقييم استخدام CPU والذاكرة ويستخدم مساحات أسماء النواة لعزل العمليات والشبكة. يتضمن قدرات لإدارة جسر الشبكة لمنع انتحال العنوان وواجهة برمجة تطبيقات برمجية لإدارة دورة حياة الحاوية وتنفيذ الأوامر الإدارية.

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning. The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking

lmctfy (pronounced l-m-c-t-fi, IPA: /ɛlɛmsitifаɪ/) is the open source version of Google’s container stack, which provides Linux application containers. These containers allow for the isolation of resources used by multiple applications running on a single machine. This gives the applications the…

Vagga is a containerization tool without daemons

A basic user tool to execute simple docker containers in batch or interactive systems without root privileges.

footloose creates containers that look like virtual machines. Those containers run systemd as PID 1 and a ssh daemon that can be used to login into the container. Such "machines" behave very much like a VM, it's even possible to run dockerd in themreadme-did :)

"railcar")

runV is a hypervisor-based runtime for OCI.

.. image:: https://travis-ci.org/01org/cc-oci-runtime.svg?branch=master :target: https://travis-ci.org/01org/cc-oci-runtime

Porto

Build and run layered root filesystems.

LIBCT