Open-source alternatives to Sudo Rs

Crossbeam is a concurrency toolkit for Rust providing low-level primitives for writing multi-threaded programs. It focuses on lock-free data structures and memory management primitives designed for shared-memory concurrent environments. The project includes a work-stealing scheduler that uses double-ended queues to balance workloads across multiple processor cores. This system enables the implementation of work-stealing deques to distribute tasks and prevent bottlenecks. The toolkit covers broader capabilities for parallel algorithm development, multi-threaded task scheduling, and general co

Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

nix is a Unix system API library and Rust system programming interface that provides type-safe bindings for invoking low-level system calls. It serves as a low-level operating system wrapper and POSIX compatibility layer, allowing for kernel interactions and administrative tasks through safe wrappers around platform-specific APIs. The project provides a kernel device interface for controlling hardware devices, managing kernel modules, and configuring terminal interfaces. It differentiates itself by offering type-safe wrappers for memory mapping and zero-copy input-output operations to reduce

Raft-rs is a Raft consensus library and distributed consensus engine implemented in Rust. It functions as a systems-level protocol implementation that provides foundational message formats and data structures for state serialization across nodes. The library executes the underlying consensus protocol to ensure multiple distributed state machines agree on a shared sequence of log entries. It coordinates state changes across a cluster of nodes to keep replicated logs synchronized and consistent. Additional capabilities include defining protocol buffer messages for consensus communication, enco

Talent Plan provides guided training programs and curricula centered on distributed database design, systems programming, and open source contribution workflows. The project offers a distributed systems education program consisting of curated courses and labs focused on database internals. The curriculum emphasizes the use of the Rust language for building high-performance networked applications and implementing distributed algorithms. It integrates educational materials on version control, community governance, and the specific processes required to contribute to public software projects. T

Supermium is a Chromium-based web browser backported to run on legacy versions of Windows. It uses an abstraction layer to adapt modern engine requirements, enabling contemporary web browsing on older operating systems that lack native support for current Chromium versions. The project integrates content decryption modules to allow the playback of DRM-protected media streams on unsupported platforms. It also features the ability to disable machine-specific encryption, allowing user profiles to be portable across different hardware installations. The browser includes a functional sandbox to i

This project is a portable implementation of the secure shell toolset designed for deployment across diverse operating systems and platforms. It provides a suite of tools for secure remote login and command execution based on the secure shell protocol. The implementation includes a sandboxed server that isolates processes to limit the impact of potential vulnerabilities on the host operating system. It also functions as a cryptographic key manager for generating and storing security keys to replace or supplement password-based authentication. The project covers encrypted file transfer for mo

Linux-NetSpeed is a network performance tuner and TCP congestion control optimizer for Linux systems. It is designed to improve bandwidth utilization, reduce latency, and increase data transfer speeds and throughput. The utility specifically provides scripts to enable and tune the BBR congestion control algorithm. It achieves this by configuring Linux kernel network parameters and managing the loading of congestion control modules. The tool covers a broad range of network optimization and server performance tuning, focusing on accelerating network traffic and overcoming bottlenecks to increa

OnlineJudge is an automated platform for managing programming contests and evaluating submitted source code. It provides a complete online judge system that compiles, runs, and scores code submissions against predefined test cases within a sandboxed execution environment, ensuring the host system remains protected from untrusted user code. The platform supports both ACM-style penalty-based scoring and OI-style point-based scoring, with real-time leaderboard computation that dynamically updates participant rankings as submissions are judged. Contest organizers can create and schedule timed com

seL4 is a formally verified microkernel whose C implementation is backed by machine-checked mathematical proofs of correctness, confidentiality, integrity, and availability. It enforces strict isolation between processes through hardware-enforced address space separation and a capability-based access control system, where each process holds explicit rights only to the resources it has been granted. The kernel exposes hardware resources through a minimal API of system calls that manage threads, address spaces, and inter-process communication, with synchronous IPC supporting sender-identifying b

Procs is a high-performance system process monitor and viewer written in Rust. It serves as a replacement for the ps command, providing a command-line interface to track active system processes and their associated CPU and memory metrics. The tool is distinguished by its container awareness, which maps system tasks to their corresponding Docker container names. It also features an interactive process tree to visualize parent and child relationships in a hierarchical layout and a JSON exporter for programmatic data analysis and automation. The monitoring surface includes real-time activity tr

Xi Editor is a high-performance text editor core written in Rust. It employs a decoupled architecture that separates core logic from the presentation layer using a JSON-based client-server protocol. The project features a language-agnostic plugin system that communicates with external extensions via JSON messages over pipes. It manages text buffers using a persistent rope data structure to enable efficient editing of very large files. The system supports asynchronous editor workflows by running expensive operations in background threads using data snapshots. This prevents background processi

Crab is a memory-safe systems programming language and ahead-of-time compiler designed for high-performance software. It utilizes a type system based on strict ownership and borrowing rules to prevent memory access errors at compile time. The toolchain includes an automated documentation generator that produces technical reference manuals and API guides by parsing structured source code annotations. It also features a dependency management tool to resolve external library graphs and ensure consistent project builds. The project covers software build automation, static type checking, and mult

Kore is an event-driven web and WebSocket server framework designed for building high-performance web services and APIs in C or Python. It functions as a secure, concurrent application framework that utilizes non-blocking I/O and isolated worker processes to handle high-concurrency traffic. The project is distinguished by a security-first architecture that features OS-level process sandboxing, privilege separation, and the isolation of private encryption keys into dedicated processes. It enables zero-downtime deployments through dynamic module hot-reloading and provides automated TLS certific

Sudo is a Windows command line utility and privilege escalation tool designed to execute individual commands with administrative privileges from an existing terminal session. It acts as an administrative access wrapper that allows specific processes to run as an administrator without requiring the user to manually open a new administrative window. The tool integrates administrative tasks directly into the Windows command line workflow, enabling the management of system configurations and protected files while maintaining the current terminal context. It facilitates elevated command execution

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte

This project is a software trial reset utility designed to clear registration markers and trial expiration data from a host system. It functions as a specialized registry cleaner that removes identity and installation date markers to extend software evaluation periods. The tool specifically focuses on the maintenance of Internet Download Manager by resetting registration flags. It bypasses trial expiration dates by identifying and deleting the local registration markers used by the application. The utility performs system-level operations, including the erasure of hidden file-system markers

This project is an AI-powered IDE extension and LLM coding assistant that provides a conversational interface for generating, refactoring, and debugging code. It functions as an AI agent framework and a Model Context Protocol client, connecting AI models to external data sources and tools to automate complex development tasks. The system is distinguished by its use of autonomous AI agents capable of multi-step task execution, including the ability to read files, modify code, and run terminal commands iteratively. It supports recursive agent orchestration through subagent delegation and employ

Hyperlight is an embedded virtual machine manager designed to execute guest binaries within hardware-isolated code sandboxes. It utilizes a KVM micro-VM manager to run untrusted third-party code, enforcing strict memory boundaries to prevent unauthorized host access. The project features a guest-host function bridge that facilitates bidirectional communication and a state snapshot tool for saving and restoring the memory state of a sandbox to reduce startup latency. The system includes a toolchain for guest binary cross-compilation and mechanisms for managing resource constraints, such as fi

Verso is a private web browser and Rust application designed for secure web browsing. It functions as a webview-based browser that embeds a pre-built engine to render web content without requiring a full browser source compilation. The project includes a cargo dependency manager that organizes Rust dependencies into local source trees. This system enables isolated software packaging by downloading external libraries to ensure the build process remains independent of external registries. The browser integrates a host-engine interface to manage navigation and user interactions. It provides too

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

This project provides a development framework for writing loadable Linux kernel modules using the Rust programming language. It establishes a methodology for safe systems programming by enforcing memory and thread safety within the restricted execution environment of the kernel, allowing developers to extend operating system functionality while preventing common memory corruption errors. The framework distinguishes itself through automated generation of type-safe foreign function interfaces, which bridge high-level code with low-level kernel headers and system structures. It maps high-level s

pyinfra is an agentless infrastructure automation framework that turns declarative Python code into idempotent shell commands to manage servers, containers, and local machines over SSH without requiring any pre-installed software on target hosts. It operates by comparing the desired state of a system against its current state, using a dry-run simulation mode to preview changes and a fact-based conditional execution engine to gather host attributes at runtime and control which operations run. The tool compiles Python operations into optimized shell commands and executes them in parallel across

Flatpak is a sandboxed application framework and standardized packaging format for Linux desktop applications. It functions as a distribution system that allows a single application bundle to run consistently across multiple Linux operating systems without requiring per-distribution builds. The project provides a runtime dependency manager that bundles specific library versions or shared runtimes to create predictable execution environments. It includes a sandbox permission manager to control application access to system hardware and resources, ensuring security and consistent behavior betwee

RyTuneX is a utility suite designed for managing operating system features, removing bloatware, and controlling data privacy settings. It functions as a system optimizer and debloater that allows users to uninstall preinstalled applications and tune system configurations to improve performance and reliability. The project includes a privacy manager to disable telemetry and block data collection tracking. It provides a dashboard for modifying system behaviors and hardware specifications through a simplified interface, including toggle switches for native operating system features. The suite c

Android-DataBackup is a rooted Android backup tool that backs up and restores complete application data on devices using Magisk, KernelSU, or APatch. It operates as a root-based backup manager, executing commands through a root shell to bypass Android's sandboxing and access app-specific data directories directly. The tool integrates with Magisk, KernelSU, and APatch to gain root-level access for reading and writing protected application data directories. It compresses backup data into tar archives to preserve file permissions, ownership, and directory structure for reliable restoration, whil