Awesome GitHub RepositoriesContainer Security

OpenHands is an autonomous agent framework designed for software engineering workflows. It provides a modular platform for orchestrating AI agents that reason, plan, and execute tasks within isolated, containerized development environments. By integrating with standard version control and development tools, the system enables agents to autonomously navigate codebases, implement features, and resolve issues through iterative reasoning and tool execution. The platform distinguishes itself through a model-agnostic orchestrator that connects diverse language models to a unified tool registry. It

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

Traefik is a cloud-native edge router and API gateway designed to manage service communication and traffic flow across distributed infrastructure. It functions as a dynamic service proxy that automatically discovers backend services and configures routing rules in real time, eliminating the need for manual restarts or complex configuration updates. By integrating directly with container orchestrators and service registries, it maintains a consistent state for network traffic, load balancing, and security policy enforcement. The project distinguishes itself through its deep integration with di

Libpod is a container management library for running and controlling the lifecycle of Open Container Initiative compliant containers and images across different storage backends. It provides a programmatic interface for the remote control and automation of container environments. The project enables the coordination of multiple containers into pods that share network namespaces and other shared resources. It supports rootless container execution by using user namespaces to launch containers without administrative privileges. The library covers a broad range of system operations, including im

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

Lima is a virtualization engine designed to provision and manage lightweight Linux, macOS, and FreeBSD virtual machines. It functions as a comprehensive virtual machine manager that leverages native hypervisors and system emulation to provide isolated environments for container development, cross-architecture testing, and secure sandboxing. The project distinguishes itself through its template-driven provisioning system, which allows users to define and automate environment configurations via local files or remote URL schemes. It integrates deeply with host systems by providing automated file

Containerd is a daemon-based container runtime that manages the complete lifecycle of containers on a host system. It functions as a core orchestration backend, handling image distribution, storage, and process execution while adhering to industry-standard specifications for container execution and configuration. The project is distinguished by its modular, plugin-based architecture, which allows for the extension of storage, runtime, and networking capabilities without requiring a full daemon recompile. It utilizes a shim-based execution model to delegate low-level operations, ensuring isola

This project is a local Kubernetes cluster manager and tool that runs control plane and worker nodes as containers on a host machine. It provides an environment for local development and automated testing by emulating a full Kubernetes cluster within a container runtime. The tool enables the creation of multi-node topologies and high-availability control planes through configuration files. It supports image sideloading to transfer container images directly from the host to nodes, bypassing remote registries, and allows for offline deployments using pre-built node images. Capabilities include

This project is a comprehensive collection of tutorials and guided laboratories designed to teach containerization, networking, and security using Docker. It serves as a learning path for building portable images and executing isolated processes. The materials provide specific guides for managing container clusters and scaling services through Docker Swarm and overlay networks. It includes a security handbook for implementing image scanning and secret management, as well as laboratories dedicated to modernizing legacy applications by wrapping older software installers into containers. The co

nerdctl is a command-line tool that manages containers and images using containerd as the runtime, providing a Docker-compatible interface for container lifecycle management. It supports running containers with the same command syntax and flags as Docker, including multi-container Compose workflows, and enables rootless container execution without host kernel escalation. The tool extends beyond basic container management with several advanced distribution and security capabilities. It can start containers before full image download by fetching only metadata and on-demand layers from eStargz-f

Buildkit is a programmable container build toolkit and OCI container image builder that converts build definitions into concurrent dependency graphs for image construction. It functions as an OCI image distribution engine, capable of generating container images and exporting artifacts to local storage or remote registries. The project is distinguished by its use of a low-level binary intermediate representation to decouple high-level build languages from the execution engine. It supports multi-platform image builds through user-mode architecture emulation and provides a distributed build cach

all-in-one is a containerized deployment system designed to install and manage a complete suite of productivity and collaboration services. It functions as a cloud suite deployer that orchestrates the installation of a self-hosted content platform, incorporating necessary dependencies via Docker or Kubernetes. The project distinguishes itself by providing a web-based dashboard for orchestrating, updating, and monitoring the lifecycle of service containers. It also serves as a local AI inference server, enabling the execution of generative text models, image diffusion, and speech processing on

Buildah is a tool for creating OCI-compliant container images without requiring a background daemon process. It functions as a daemonless image constructor and distribution tool, allowing users to build, push, and pull images between local storage and remote registries. The project distinguishes itself by supporting unprivileged image building through the use of user namespaces and rootless mode. It enables direct modification of container root filesystems by mounting them to the host, allowing images to be treated as directories that can be manipulated via standard shell commands or scripts.

Youki ist eine OCI-Container-Runtime, die in Rust geschrieben ist. Sie implementiert die OCI-Runtime-Spezifikation (Open Container Initiative), um den Lebenszyklus containerisierter Prozesse zu verwalten und die Kompatibilität mit Standard-Container-Images und -Engines sicherzustellen. Die Runtime ist auf Speichersicherheit ausgelegt und unterstützt die Ausführung von rootless Containern, wodurch Container als Nicht-Root-Benutzer ausgeführt werden können, um Sicherheitsrisiken zu reduzieren und Privilegienerweiterungen zu begrenzen. Sie bietet grundlegende Funktionen für das Containermanagement, einschließlich des Startens und Verwaltens von OCI-Containern. Dies wird durch Linux-Namespace-Isolierung, cgroup-basierte Ressourcenbegrenzung und User-Namespace-Mapping erreicht, um Prozesse vom Host-Betriebssystem zu trennen.

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

Calico is a cloud-native networking and security solution designed to connect containerized workloads across virtual machines, bare metal, and multi-cloud environments. It provides a routing solution based on the Border Gateway Protocol to manage cluster traffic and implement the Container Network Interface for pod connectivity and IP address management. The project distinguishes itself through a security layer that enforces network policies based on identities and labels rather than static addresses. It includes a policy engine for controlling traffic flow, a cluster network encryptor for se

podman-compose ist ein Command-Line-Tool und ein Wrapper für die Compose-Spezifikation, der YAML-Definitionen in Befehle für die Podman-Container-Engine übersetzt. Es fungiert als Multi-Container-Orchestrator, der Anwendungs-Stacks bereitstellt, ohne dass ein Hintergrund-Daemon-Prozess erforderlich ist. Das Tool ermöglicht ein rootloses Container-Management, wodurch die Ausführung containerisierter Anwendungen und Dienste ohne administrative Privilegien auf dem Host möglich ist. Es übersetzt High-Level-Compose-Befehle in individuelle Shell-Aufrufe, um das Deployment mehrerer Container zu koordinieren. Das System verwaltet Container-Netzwerke mit DNS-basierter Namensauflösung, damit Dienste über Netzwerkadressen kommunizieren können. Es handhabt zudem die sequenzielle Bereitstellung von Diensten basierend auf Abhängigkeitsdefinitionen und bildet Benutzer-Berechtigungen auf Container-Namespaces ab.

Finch ist eine auf virtuellen Maschinen basierende Container-Runtime und ein OCI-Container-Management-CLI für die lokale Container-Entwicklung. Es führt Container-Workloads in einer Hintergrund-VM aus, um sie vom Host-Betriebssystem zu isolieren. Das Projekt dient als OCI-Image-Builder und Multi-Container-Service-Orchestrator zur Simulation komplexer Produktionsumgebungen auf einer Workstation. Die Runtime fungiert als plattformübergreifende Container-Engine und nutzt Emulationsschichten, um Container-Images für fremde CPU-Architekturen auszuführen. Sie zeichnet sich bei der Image-Verteilung durch Lazy-Loading-Unterstützung und die Generierung durchsuchbarer Indizes aus, wodurch Container gestartet werden können, bevor der vollständige Image-Pull abgeschlossen ist. Das Projekt deckt ein breites Spektrum an Funktionen ab, darunter OCI-Image-Lifecycle-Management, VM-Ressourcenkonfiguration und Multi-Container-Orchestrierung. Es bietet Tools für Netzwerkmanagement, Volume-Persistenz sowie Image-Signierung und -Verifizierung. Das System umfasst ein Command-Line-Interface mit Unterstützung für Shell-Autovervollständigung und Kompatibilität mit Legacy-Container-Befehlen.

proot-distro is a rootless container runtime and Linux distribution manager that allows users to install and run isolated guest environments without requiring administrative root privileges. It utilizes PRoot to simulate root access and filesystem redirection, enabling the deployment of full Linux distributions in a non-root space. The project functions as an OCI container image handler, capable of building, pulling, and pushing OCI-compatible images and manifests. It further serves as a cross-architecture execution layer, utilizing user-mode emulation to run binaries and containers built for