Awesome GitHub RepositoriesNetwork Namespace Virtualization

dockerlabs is a collection of educational labs and technical tutorials designed to teach the fundamentals of containerization and microservice architecture. It provides instructional material and hands-on exercises covering image optimization, security training, infrastructure setup, and cluster orchestration. The project features specific courses and guides focused on reducing image size through multi-stage builds, securing workloads via vulnerability scanning and encrypted networks, and deploying multi-node clusters with high availability using Swarm orchestration. The materials cover a br

Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi

Weave is a multi-host container networking tool that connects containers running on different physical machines into a single virtual network. It creates a software-defined overlay network spanning multiple hosts, enabling containers to communicate directly with each other as if they were on the same local switch. The system provides automatic service discovery, resolving container names to network addresses across hosts without manual configuration. Traffic between containers on different hosts is secured through encrypted tunnels, preventing eavesdropping and tampering. Weave also includes

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

Mininet is a network emulator that creates virtual networks of hosts, switches, and links on a single Linux machine for Software-Defined Networking (SDN) prototyping and testing. It emulates network nodes as lightweight processes in isolated network namespaces, connecting them via virtual Ethernet pairs, and supports OpenFlow protocol for programmable control of virtual switches and traffic flows. The project enables users to design custom network topologies using a Python API, simulate link conditions such as bandwidth, delay, and packet loss, and run real Linux applications and kernel code

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

Testcontainers for .NET هي مكتبة اختبار Docker وإطار عمل لاختبار التكامل مصمم لإدارة دورة حياة الحاويات المؤقتة. توفر تجريدات عالية المستوى كغلاف لواجهة برمجة تطبيقات Docker لتوفير بنية تحتية سريعة الزوال، واستبدال المحاكيات (mocks) بقواعد بيانات حقيقية، ومراسلات، ومثيلات محركات بحث لضمان بيئات اختبار معزولة وقابلة للتكرار. يتميز المشروع بنمط حاوية تكوين البناء وآلية ربط المنافذ الديناميكية التي تمنع التصادمات أثناء تنفيذ الاختبار المتزامن. يتيح اتصالاً موثوقاً بين الخدمات عبر تنسيق الشبكة الافتراضية وتسمية الشبكة المستعارة، ويضمن توفر الخدمة من خلال فحوصات الجاهزية القائمة على الاستطلاع (polling) لنقاط نهاية HTTP ومنافذ TCP. توفر المكتبة وحدات متخصصة لقواعد البيانات العلائقية، وNoSQL، وقواعد بيانات المتجهات، بالإضافة إلى وسطاء المراسلة ومحاكيات الخدمات السحابية. تمتد قدراتها إلى تكوين صور الحاويات، وجمع السجلات، ومحاكاة ظروف الشبكة للتحقق من مرونة النظام. تدعم الاتصال بأوقات تشغيل Docker المحلية والبعيدة من خلال متغيرات البيئة وملفات التكوين الموحدة.

Pipework هو مجموعة أدوات شبكات معرفة برمجياً وأداة إدارة مصممة لأتمتة تكوينات الشبكة لحاويات Linux. يوفر أدوات لإدارة عناوين IP، وإنشاء طوبولوجيا شبكة افتراضية، ودمج الحاويات في بنيات شبكة متنوعة. يتميز المشروع بدعم متخصص لتكوين أجهزة InfiniBand IPoIB، بما في ذلك إدارة مفاتيح التقسيم. كما يتميز بالتكامل مع Open vSwitch لأتمتة الجسر وعزل VLAN، بالإضافة إلى القدرة على ربط الحاويات مباشرة بأجهزة المضيف المادية عبر واجهات macvlan الفرعية. تغطي قدراته الأوسع إدارة شاملة للشبكة، بما في ذلك تعيين IP الثابت و DHCP، ومعالجة قواعد التوجيه، وتهيئة البوابة الافتراضية. كما يتضمن أدوات لمراقبة جاهزية الواجهة ومحاكاة ظروف الشبكة مثل زمن الوصول وفقدان الحزم داخل مساحات أسماء الحاويات.

The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo