Sysbox

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning.

The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker workflows, and uses shiftfs overlay filesystem for shared filesystem access between host and container namespaces. Sysbox also integrates OCI runtime hooks to configure namespaces, cgroups, and mounts at container lifecycle events.

The project provides capabilities for partitioning bare-metal or cloud instances into multiple isolated compute environments with higher density than virtual machines, and for replacing virtual machines with faster, more portable containers for running legacy applications and multi-service workloads. Documentation and installation instructions are available through the project's repository.

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Star-Verlauf

nestyboxsysbox

Name: nestybox/sysbox
Author: nestybox

View on GitHub

3,458 Stars201 ForksShellapache-2.02 Aufrufe

Sysbox

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Open-Source-Alternativen zu Sysbox

Ähnliche Open-Source-Projekte, sortiert nach der Anzahl der gemeinsamen Funktionen mit Sysbox.

lxc/lxc
lxc/lxc
5,204Auf GitHub ansehen
LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile
C
Auf GitHub ansehen5,204
opencontainers/runc
opencontainers/runc
13,067Auf GitHub ansehen
runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container Initiative specification. It serves as a low-level container execution engine that interfaces directly with the host operating system to manage the lifecycle of isolated processes. The tool functions as a Linux process containerizer, utilizing kernel features such as namespaces for process isolation and control groups for resource governance. It enforces security by restricting processes to specific directory trees and dropping unnecessary kernel privileges to minimize the attac
Gocontainersdockeroci
Auf GitHub ansehen13,067
containers/bubblewrap
containers/bubblewrap
5,839Auf GitHub ansehen
Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc
Clinux-containersuser-namespaces
Auf GitHub ansehen5,839

Häufig gestellte Fragen

Was macht nestybox/sysbox?

Was sind die Hauptfunktionen von nestybox/sysbox?

Die Hauptfunktionen von nestybox/sysbox sind: VM-Like Isolation Runtimes, Container, ID-Shifting, Repository-Built Container Hook Runs, System Software Container Runs, System Software Container Execution, Docker-in-Docker Runtimes, Inner Container Deployments.

Welche Open-Source-Alternativen gibt es zu nestybox/sysbox?

Open-Source-Alternativen zu nestybox/sysbox sind unter anderem: lxc/lxc — LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on… opencontainers/runc — runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container… lxc/incus — Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual… actions/actions-runner-controller — Kubernetes controller for GitHub Actions self-hosted runners. containers/bubblewrap — Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted… containers/crun — crun is a low-level container runtime that implements the Open Container Initiative specification for managing the…