Awesome GitHub RepositoriesRemote Image Inspection

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

Skopeo es una utilidad de línea de comandos para inspeccionar, copiar y gestionar imágenes de contenedores OCI y Docker a través de registros y almacenamiento local. Funciona como una herramienta de imágenes de contenedores y gestor de registros que realiza estas operaciones sin necesidad de que un demonio en segundo plano se esté ejecutando en el host. La herramienta se especializa en la manipulación de imágenes sin demonio (daemonless), permitiendo a los usuarios recuperar metadatos, manifiestos y etiquetas de registros remotos sin descargar la imagen completa localmente. Proporciona capacidades para replicar repositorios externos a registros internos para despliegues en entornos aislados (air-gapped) y gestiona la transferencia de imágenes entre diferentes registros remotos y directorios del sistema de archivos local. Las capacidades adicionales cubren la seguridad de las imágenes de contenedores mediante la generación y verificación de firmas criptográficas para garantizar la integridad de la imagen. La utilidad también gestiona la administración del registro, incluyendo la eliminación de imágenes y el listado de etiquetas, mientras gestiona la autenticación para registros privados.

Skopeo is an OCI container image manager and registry client designed for inspecting, copying, and signing container images across different registries and storage backends. It enables the manipulation of container images using direct API calls to registries, operating independently of a local container daemon or runtime. The tool provides specialized capabilities for container image mirroring and synchronization, specifically supporting the mirroring of external repositories to internal registries for air-gapped environments. It also functions as a container image signing tool, allowing for

dockerlabs is a collection of educational labs and technical tutorials designed to teach the fundamentals of containerization and microservice architecture. It provides instructional material and hands-on exercises covering image optimization, security training, infrastructure setup, and cluster orchestration. The project features specific courses and guides focused on reducing image size through multi-stage builds, securing workloads via vulnerability scanning and encrypted networks, and deploying multi-node clusters with high availability using Swarm orchestration. The materials cover a br

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr

Finch es un runtime de contenedores basado en máquinas virtuales y una CLI de gestión de contenedores OCI utilizada para el desarrollo local de contenedores. Opera ejecutando cargas de trabajo de contenedores dentro de una máquina virtual en segundo plano para aislarlos del sistema operativo anfitrión. El proyecto sirve como constructor de imágenes OCI y orquestador de servicios multicontenedor para simular entornos de producción complejos en una estación de trabajo. El runtime funciona como un motor de contenedores multiplataforma, utilizando capas de emulación para ejecutar imágenes de contenedores construidas para arquitecturas de CPU extranjeras. Se distingue en la distribución de imágenes mediante soporte de carga diferida (lazy-loading) y la generación de índices buscables, permitiendo que los contenedores inicien antes de que se complete la descarga total de la imagen. El proyecto cubre una amplia gama de capacidades, incluyendo la gestión del ciclo de vida de imágenes OCI, la configuración de recursos de máquinas virtuales y la orquestación de aplicaciones multicontenedor. Proporciona herramientas para la gestión de redes, persistencia de volúmenes y firma y verificación de imágenes. El sistema incluye una interfaz de línea de comandos con soporte para autocompletado de shell y compatibilidad con comandos de contenedores heredados.

img is a collection of toolsets for building, managing, and manipulating OCI compliant container images. It functions as an image build tool and registry client, providing the capabilities to create images from configuration files, push and pull images to remote registries, and extract image layers into root filesystems or archives. The project distinguishes itself through support for multi-platform builds using hardware emulators and the ability to perform unprivileged container builds via namespace-based process isolation and user ID mapping. It also includes a cross-platform binary compile