Awesome GitHub RepositoriesOCI Runtime Implementations

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

Meshery is a service mesh management plane and cloud native infrastructure orchestrator. It provides a visual design-as-code environment for modeling microservices and infrastructure components through declarative blueprints, functioning as a centralized platform for designing, deploying, and managing service mesh infrastructure. The platform is distinguished by its ability to translate visual designs into active deployments and its use of gRPC-based adapters to integrate with diverse infrastructure providers. It features a multi-tenant architecture that manages shared workspaces and role-bas

rkt is a secure Linux container engine and pod-native container manager. It provides a composable execution environment for launching and managing isolated application containers on Linux, serving as a runtime designed around open industry standards for image formats and networking interfaces. The system is distinguished by a pod-native execution model that groups multiple containers and shared resources into single, self-contained units. It utilizes pluggable execution engines to provide secure isolation, including the use of hardware-based virtualization to create security boundaries betwee

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

Youki هو وقت تشغيل حاوية OCI مكتوب بلغة Rust. ينفذ مواصفات وقت تشغيل مبادرة الحاوية المفتوحة (OCI) لإدارة دورة حياة العمليات الحاوية وضمان التوافق مع صور ومحركات الحاويات القياسية. تم تصميم وقت التشغيل لسلامة الذاكرة ويدعم تنفيذ الحاوية بدون جذر (Rootless)، مما يسمح للحاويات بالعمل كمستخدمين غير جذريين لتقليل مخاطر الأمان والحد من تصعيد الامتيازات. يوفر قدرات أساسية لإدارة الحاويات، بما في ذلك إنشاء وإدارة حاويات OCI. يتم تحقيق ذلك من خلال عزل مساحة اسم Linux، وتحديد الموارد القائم على cgroup، وتعيين مساحة اسم المستخدم لتقسيم العمليات عن نظام التشغيل المضيف.

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

x11docker is an OCI container GUI orchestrator and hardware bridge designed to execute graphical applications and full desktop environments inside containers. It functions as a Linux GUI sandbox, linking containerized processes to host X11 or Wayland display servers and audio systems. The project differentiates itself by providing deep system integration for hardware acceleration, including NVIDIA driver automation and GPU passthrough. It supports cross-architecture GUI emulation and provides remote access capabilities through VNC, SSH forwarding, and browser-based HTML5 rendering. The tool

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

Pouch is a Linux container runtime and OCI container engine designed to execute containerized applications. It functions as a Kubernetes container runtime, integrating with orchestrators to manage the lifecycle of pods and isolated application environments. The project features a peer-to-peer image distribution system to deliver large container images across large-scale clusters while reducing bandwidth load. It also provides support for legacy Linux kernel versions, allowing modern container runtimes to maintain compatibility with older hardware. The runtime implements application isolation

crun هو وقت تشغيل حاويات منخفض المستوى ينفذ مواصفات Open Container Initiative لإدارة دورة حياة العمليات المعزولة. يوفر الآليات الأساسية لإنشاء الحاويات وتنفيذها وحذفها، مما يضمن التوافق عبر المنصات من خلال إدارة دورة الحياة الموحدة. يتميز المشروع بتقديم مكتبة C مشتركة تسمح بتضمين عمليات وقت تشغيل الحاوية مباشرة في تطبيقات أخرى مترجمة. كما يوسع قدرات التنفيذ من خلال معالجات متخصصة تمكن من نشر الحاويات داخل microVMs معزولة أو تنفيذ أحمال عمل WebAssembly. يغطي وقت التشغيل مجموعة واسعة من قدرات العزل وإدارة الموارد منخفضة المستوى. يتضمن ذلك استخدام مساحات الأسماء (namespaces) ومرشحات seccomp للأمان، و cgroups لفرض حدود CPU والذاكرة، وأدوات لحفظ واستئناف حالات تنفيذ الحاوية عبر نقطة التفتيش والاستعادة. كما يوفر واجهات لتحديثات الموارد الديناميكية، وإدارة التثبيت، والأتمتة عبر واجهة Lua مضمنة.

Unikraft is a modular library operating system and unikernel framework designed to compile applications into minimal, bootable virtual machine images. It serves as an OCI-compliant image builder and a cloud-native hypervisor target, enabling the creation of specialized runtimes that include only the specific drivers and libraries required by a single application. The system features a Linux compatibility layer that maps standard API calls and POSIX standards to unikernel libraries, allowing unmodified binaries to run without a full general-purpose kernel. It distinguishes itself by allowing c