Open-source alternatives to Firecracker

Cloud Hypervisor is a Rust-based hypervisor and KVM virtual machine monitor designed to execute 64-bit guest operating systems. It functions as a user-space virtual machine manager that employs a minimal emulation layer to reduce memory overhead and latency for cloud workloads. The project distinguishes itself through the use of a memory-safe language to implement a virtio device emulator and a user-space device model. It provides a standardized web API for managing virtual machine lifecycles and resource configurations. The platform covers broad virtualization capabilities, including the em

Vagga is a containerization tool without daemons

WSL is a compatibility layer and virtualization platform that enables the execution of native Linux binaries directly on a host operating system. By utilizing a lightweight virtual machine and direct kernel system call mapping, it provides a high-performance environment that bridges Linux-based command line utilities with host-native tools. This architecture allows for full system call compatibility while maintaining minimal resource overhead. The platform distinguishes itself through deep integration with the host environment, allowing users to run isolated Linux distributions alongside stan

This project provides a containerized virtualization engine that runs full Windows operating system instances within isolated containers. By acting as a cross-platform virtualization runtime, it enables the deployment of desktop environments on any host that supports standard container runtimes, ensuring consistent execution across diverse infrastructure. The system distinguishes itself by utilizing kernel-level virtualization primitives and hardware emulation to execute guest operating systems. It leverages accelerated kernel execution to offload CPU instructions to the host processor for pe

Fission is a function-as-a-service platform and serverless framework for Kubernetes. It manages the lifecycle and execution of code snippets as serverless functions, providing an orchestrator that triggers these functions based on HTTP requests, message queues, or scheduled events. The platform features a cold-start optimized runtime that utilizes warm container pools and dynamic loaders to achieve millisecond execution. It includes a native autoscaler to adjust the number of function instances based on real-time traffic demand and supports canary release testing to split incoming traffic bet

一款轻量级、跨平台的 Mini Kubernetes AI Dashboard，支持大模型+智能体+MCP(支持设置操作权限)，集成多集群管理、智能分析、实时异常检测等功能，支持多架构并可单文件部署，助力高效集群管理与运维优化。

Pi-hole is a self-hosted network utility that functions as a DNS sinkhole server to provide network-wide ad blocking. By acting as a dedicated network gateway, it intercepts and discards requests for known advertising, tracking, and malicious domains across an entire local network, preventing unwanted content from loading on any connected device. The software operates through a lightweight background daemon that handles high volumes of concurrent DNS queries with minimal resource overhead. It utilizes a host-file injection mechanism to redirect traffic toward its local filtering engine and ap

This project serves as a comprehensive knowledge base and directory for the container orchestration ecosystem. It functions as a curated index of tools, tutorials, and technical documentation designed to assist developers and operators in managing, scaling, and maintaining containerized applications. The repository operates through community-driven content curation, maintaining a structured collection of resources within a version-controlled environment. It distinguishes itself by providing a vetted index that helps users locate specific utilities for infrastructure management and DevOps task

MKP is a Model Context Protocol (MCP) server for Kubernetes

MCP server connecting to Kubernetes

This project is a comprehensive, community-driven directory that serves as a centralized discovery hub for the container ecosystem. It functions as a structured knowledge base, aggregating a wide array of software tools, educational materials, and technical resources designed to assist developers and operators in mastering containerization technologies. The repository distinguishes itself through a meticulously organized taxonomy that maps the entire container lifecycle, from initial development and image building to orchestration, security, and infrastructure operations. By curating disparat

Security Monkey is a cloud security posture management tool and configuration auditor. It functions as a monitoring platform that tracks cloud assets and records state changes to identify when security policies are altered or insecure configurations are introduced. The system maintains a multi-cloud asset inventory, tracking resources across AWS, GCP, OpenStack, and GitHub organizations. It provides a centralized interface for searching and browsing assets across multiple cloud providers and regions. The platform covers cloud security auditing and infrastructure change tracking by comparing

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

Organizr is a self-hosted service dashboard that aggregates links to all of your self-hosted applications into a single landing page for quick access. It functions as a unified tab manager, loading multiple services as individual tabs within one webpage to consolidate browser tabs and reduce clutter. The project provides role-based access control, restricting dashboard visibility and service links based on user authentication and permissions. It includes an external authentication gateway that validates credentials through Plex, Emby, LDAP, or sFTP, and a user management backend for creating,

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

Booster Framework

A curated list of Site Reliability and Production Engineering resources.

Streisand is an orchestration system for deploying multi-protocol tunneling services and traffic obfuscation tools designed to circumvent regional network restrictions. It functions as a deployment utility and manager for various VPN and proxy services on remote cloud servers. The system distinguishes itself through a network obfuscation toolkit that wraps traffic in layers to evade deep packet inspection and bandwidth throttling. It automates the setup of multiple protocols, including WireGuard, OpenVPN, Shadowsocks, OpenConnect, OpenSSH, and Tor bridges. The project also includes utilities

This project is a secure container runtime that provides strong isolation for application workloads by implementing a userspace kernel. By intercepting system calls and executing them within a memory-safe, restricted environment, it minimizes the attack surface exposed to the host kernel. It functions as a drop-in engine for standard container orchestration platforms, ensuring compatibility with industry-standard runtime specifications while maintaining a hardened execution boundary. The runtime distinguishes itself through its ability to virtualize core system resources, including an indepen

SerenityOS is a complete, self-hosted desktop operating system built from the kernel up. It features a monolithic kernel architecture that manages system services, hardware drivers, and networking within a single address space. The system provides a full computing environment, including a proprietary windowing system and a suite of native desktop applications, all while maintaining a POSIX-compliant interface for standard system programming. The project is distinguished by its integrated development workflow, which relies on a cross-compilation build pipeline to generate system images from ho

Docker Compose is a tool for defining and running multi-container applications through declarative configuration files. It functions as an application lifecycle manager, coordinating the startup, shutdown, and scaling of interconnected services within isolated environments. By using a standardized configuration format, it enables infrastructure as code, allowing developers to manage complex application stacks and their dependencies in a single, repeatable file. The project distinguishes itself by integrating directly with the broader Docker platform, leveraging a client-server architecture wh

Airflow is a platform for programmatically authoring, scheduling, and monitoring complex data pipelines. It functions as a workflow automation engine that manages the lifecycle of recurring business processes by executing code-defined task dependencies. By representing workflows as directed acyclic graphs, the system ensures that task execution order and data flow are explicitly defined and reliably maintained across distributed computing environments. The platform distinguishes itself through a highly modular, provider-based architecture that decouples core orchestration logic from external

This project is a Linux kernel designed for Windows Linux integration, providing the underlying operating system kernel required to execute binary files and applications within the Windows Subsystem for Linux. It utilizes hypervisor-based virtualization to run a full kernel within a lightweight utility virtual machine managed by a Windows host. The repository enables the customization and compilation of the kernel from source. This allows for the modification of system behavior, the addition of specific drivers, and the tailoring of hardware compatibility for virtualized environments. The sy

OpenSandbox is a secure execution environment and runtime designed for running untrusted code and scripts generated by AI agents. It utilizes a containerized code execution engine and microVM-based isolation to protect host systems from malicious actions while providing isolated virtual environments. The project features a sandbox server based on the Model Context Protocol to automate the creation and control of virtual workspaces. It supports the deployment of secure remote desktop hosts, including headless web browsers and editor instances, for automated interaction. The system includes an

Hyperkit is a userspace virtual machine monitor and a development toolkit for building custom hypervisors. It provides primitives for embedding virtualization and hardware emulation capabilities directly into applications to execute guest operating systems within a userspace environment. The project features a guest operating system bootstrapping tool that loads kernels and initializes CPU states without relying on traditional firmware. It includes a hardware emulation library to create virtualized storage, serial ports, and networking components for guest system access. The system covers vi

Colima is a command-line utility that provides lightweight container runtimes and local Kubernetes orchestration by managing isolated virtual machine environments. It functions as a virtualization manager that abstracts the underlying container engine, allowing users to run containerized applications and system workloads on non-native operating systems without the overhead of heavy desktop software. The project distinguishes itself through its support for hardware-accelerated workloads, enabling direct GPU passthrough to virtual machines for high-performance machine learning tasks. It offers

WSABuilds is a management framework designed to deploy and customize virtualized mobile runtime environments on desktop operating systems. It provides a comprehensive suite of tools for building, installing, and maintaining these environments, enabling the native execution of mobile applications alongside standard desktop software. The project distinguishes itself through its focus on deep system integration and lifecycle management. It allows users to generate tailored virtual environment packages by injecting administrative tools, service components, and specific configurations prior to dep