Awesome GitHub RepositoriesUID/GID Remapping

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

mergerfs is a FUSE-based union filesystem that pools multiple independent filesystems or directories into a single unified mount point. It acts as a proxy to underlying storage, forwarding file operations directly to the filesystem for near-native performance while merging directory listings and attribute changes. The project provides a live, read-write pooled view of storage that aggregates drives of any size without requiring reformatting or data redistribution, and it isolates individual drive failures so that the pool continues serving data from remaining filesystems. The filesystem offer

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

LXC ist ein OS-Level-Virtualisierungs-Framework und Linux-Container-Manager, der verwendet wird, um mehrere isolierte Linux-Systeme auf einem einzigen Host auszuführen. Er fungiert als Kernel-Namespace-Orchestrator und unprivilegierte Container-Runtime, was die Erstellung und Verwaltung von Systemcontainern ohne den Overhead eines Hypervisors ermöglicht. Das Projekt bietet unprivilegierte Containerausführung durch das Mapping von Container-Root-Benutzern auf unprivilegierte Host-Benutzer, um den Zugriff auf das Host-System zu verhindern. Es stellt Sicherheit durch System-Call-Filtering und Root-Benutzer-Isolierung sicher, wodurch Container ohne Host-Root-Rechte ausgeführt werden können. Das Framework verwaltet die Ressourcenisolierung mithilfe von Control Groups, um CPU- und Speichernutzung zu begrenzen, und nutzt Kernel-Namespaces für die Prozess- und Netzwerkisolierung. Es enthält Funktionen für die Netzwerk-Bridge-Administration zur Verhinderung von Adress-Spoofing sowie eine programmatische API zur Verwaltung des Container-Lebenszyklus und zur Ausführung administrativer Befehle.

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

Dieses Projekt bietet containerisierte Distribution-Templates und Images für das Deployment eines Medienservers. Es ermöglicht den Betrieb eines Medienservers innerhalb von Docker- oder Kubernetes-Umgebungen und nutzt Paketmanagement-Charts, um die Installation und Verwaltung von Home-Cinema-Bibliotheken zu optimieren. Das Projekt konzentriert sich auf leistungsstarke Videoverarbeitung durch hardwarebeschleunigtes Transcoding, das durch das Durchreichen von GPU-Geräten an den Container erreicht wird. Es stellt die Datenpersistenz durch das Mapping von Host-Verzeichnissen für Konfigurationsdatenbanken und groß angelegte Medienbibliotheken sicher. Das System deckt ein breites Spektrum operativer Funktionen ab, einschließlich Netzwerkkonfiguration für Bridge- oder Host-Modi, Ingress-Routing für externes Hostname-Mapping und die Abstimmung von Benutzerberechtigungen zur Verwaltung des Dateizugriffs. Es enthält zudem Mechanismen zur Server-Identitätsauthentifizierung mittels Claim-Tokens und automatisierte Binär-Updates, die durch Image-Tags ausgelöst werden. Das Deployment wird durch Kubernetes-Helm-Charts und Docker-Images unterstützt.

The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning. The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo