Awesome GitHub RepositoriesContainer Security

OpenHands is an autonomous agent framework designed for software engineering workflows. It provides a modular platform for orchestrating AI agents that reason, plan, and execute tasks within isolated, containerized development environments. By integrating with standard version control and development tools, the system enables agents to autonomously navigate codebases, implement features, and resolve issues through iterative reasoning and tool execution. The platform distinguishes itself through a model-agnostic orchestrator that connects diverse language models to a unified tool registry. It

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

Traefik is a cloud-native edge router and API gateway designed to manage service communication and traffic flow across distributed infrastructure. It functions as a dynamic service proxy that automatically discovers backend services and configures routing rules in real time, eliminating the need for manual restarts or complex configuration updates. By integrating directly with container orchestrators and service registries, it maintains a consistent state for network traffic, load balancing, and security policy enforcement. The project distinguishes itself through its deep integration with di

Libpod is a container management library for running and controlling the lifecycle of Open Container Initiative compliant containers and images across different storage backends. It provides a programmatic interface for the remote control and automation of container environments. The project enables the coordination of multiple containers into pods that share network namespaces and other shared resources. It supports rootless container execution by using user namespaces to launch containers without administrative privileges. The library covers a broad range of system operations, including im

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

Lima is a virtualization engine designed to provision and manage lightweight Linux, macOS, and FreeBSD virtual machines. It functions as a comprehensive virtual machine manager that leverages native hypervisors and system emulation to provide isolated environments for container development, cross-architecture testing, and secure sandboxing. The project distinguishes itself through its template-driven provisioning system, which allows users to define and automate environment configurations via local files or remote URL schemes. It integrates deeply with host systems by providing automated file

Containerd is a daemon-based container runtime that manages the complete lifecycle of containers on a host system. It functions as a core orchestration backend, handling image distribution, storage, and process execution while adhering to industry-standard specifications for container execution and configuration. The project is distinguished by its modular, plugin-based architecture, which allows for the extension of storage, runtime, and networking capabilities without requiring a full daemon recompile. It utilizes a shim-based execution model to delegate low-level operations, ensuring isola

This project is a local Kubernetes cluster manager and tool that runs control plane and worker nodes as containers on a host machine. It provides an environment for local development and automated testing by emulating a full Kubernetes cluster within a container runtime. The tool enables the creation of multi-node topologies and high-availability control planes through configuration files. It supports image sideloading to transfer container images directly from the host to nodes, bypassing remote registries, and allows for offline deployments using pre-built node images. Capabilities include

This project is a comprehensive collection of tutorials and guided laboratories designed to teach containerization, networking, and security using Docker. It serves as a learning path for building portable images and executing isolated processes. The materials provide specific guides for managing container clusters and scaling services through Docker Swarm and overlay networks. It includes a security handbook for implementing image scanning and secret management, as well as laboratories dedicated to modernizing legacy applications by wrapping older software installers into containers. The co

nerdctl is a command-line tool that manages containers and images using containerd as the runtime, providing a Docker-compatible interface for container lifecycle management. It supports running containers with the same command syntax and flags as Docker, including multi-container Compose workflows, and enables rootless container execution without host kernel escalation. The tool extends beyond basic container management with several advanced distribution and security capabilities. It can start containers before full image download by fetching only metadata and on-demand layers from eStargz-f

Buildkit is a programmable container build toolkit and OCI container image builder that converts build definitions into concurrent dependency graphs for image construction. It functions as an OCI image distribution engine, capable of generating container images and exporting artifacts to local storage or remote registries. The project is distinguished by its use of a low-level binary intermediate representation to decouple high-level build languages from the execution engine. It supports multi-platform image builds through user-mode architecture emulation and provides a distributed build cach

all-in-one is a containerized deployment system designed to install and manage a complete suite of productivity and collaboration services. It functions as a cloud suite deployer that orchestrates the installation of a self-hosted content platform, incorporating necessary dependencies via Docker or Kubernetes. The project distinguishes itself by providing a web-based dashboard for orchestrating, updating, and monitoring the lifecycle of service containers. It also serves as a local AI inference server, enabling the execution of generative text models, image diffusion, and speech processing on

Buildah is a tool for creating OCI-compliant container images without requiring a background daemon process. It functions as a daemonless image constructor and distribution tool, allowing users to build, push, and pull images between local storage and remote registries. The project distinguishes itself by supporting unprivileged image building through the use of user namespaces and rootless mode. It enables direct modification of container root filesystems by mounting them to the host, allowing images to be treated as directories that can be manipulated via standard shell commands or scripts.

Youki es un runtime de contenedores OCI escrito en Rust. Implementa la especificación de runtime de la Open Container Initiative para gestionar el ciclo de vida de los procesos contenedorizados y garantizar la compatibilidad con imágenes y motores de contenedores estándar. El runtime está diseñado para la seguridad de memoria y admite la ejecución de contenedores sin privilegios (rootless), permitiendo que los contenedores se ejecuten como usuarios no root para reducir los riesgos de seguridad y limitar la escalada de privilegios. Proporciona capacidades principales de gestión de contenedores, incluyendo la creación y gestión de contenedores OCI. Esto se logra mediante el aislamiento de espacios de nombres (namespaces) de Linux, la limitación de recursos basada en cgroups y el mapeo de espacios de nombres de usuario para particionar los procesos del sistema operativo anfitrión.

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

Calico is a cloud-native networking and security solution designed to connect containerized workloads across virtual machines, bare metal, and multi-cloud environments. It provides a routing solution based on the Border Gateway Protocol to manage cluster traffic and implement the Container Network Interface for pod connectivity and IP address management. The project distinguishes itself through a security layer that enforces network policies based on identities and labels rather than static addresses. It includes a policy engine for controlling traffic flow, a cluster network encryptor for se

podman-compose es una herramienta de línea de comandos y un wrapper de especificación compose que traduce definiciones YAML en comandos para el motor de contenedores Podman. Funciona como un orquestador de múltiples contenedores que despliega stacks de aplicaciones sin requerir un proceso de demonio en segundo plano. La herramienta permite la gestión de contenedores sin root, permitiendo la ejecución de aplicaciones y servicios contenedorizados sin privilegios administrativos en el host. Traduce comandos compose de alto nivel en llamadas de shell individuales para coordinar el despliegue de múltiples contenedores. El sistema gestiona redes de contenedores con resolución de nombres basada en DNS para permitir que los servicios se comuniquen a través de direcciones de red. También maneja el aprovisionamiento secuencial de servicios basado en definiciones de dependencias y mapea permisos de espacio de usuario a namespaces de contenedores.

Finch es un runtime de contenedores basado en máquinas virtuales y una CLI de gestión de contenedores OCI utilizada para el desarrollo local de contenedores. Opera ejecutando cargas de trabajo de contenedores dentro de una máquina virtual en segundo plano para aislarlos del sistema operativo anfitrión. El proyecto sirve como constructor de imágenes OCI y orquestador de servicios multicontenedor para simular entornos de producción complejos en una estación de trabajo. El runtime funciona como un motor de contenedores multiplataforma, utilizando capas de emulación para ejecutar imágenes de contenedores construidas para arquitecturas de CPU extranjeras. Se distingue en la distribución de imágenes mediante soporte de carga diferida (lazy-loading) y la generación de índices buscables, permitiendo que los contenedores inicien antes de que se complete la descarga total de la imagen. El proyecto cubre una amplia gama de capacidades, incluyendo la gestión del ciclo de vida de imágenes OCI, la configuración de recursos de máquinas virtuales y la orquestación de aplicaciones multicontenedor. Proporciona herramientas para la gestión de redes, persistencia de volúmenes y firma y verificación de imágenes. El sistema incluye una interfaz de línea de comandos con soporte para autocompletado de shell y compatibilidad con comandos de contenedores heredados.

proot-distro is a rootless container runtime and Linux distribution manager that allows users to install and run isolated guest environments without requiring administrative root privileges. It utilizes PRoot to simulate root access and filesystem redirection, enabling the deployment of full Linux distributions in a non-root space. The project functions as an OCI container image handler, capable of building, pulling, and pushing OCI-compatible images and manifests. It further serves as a cross-architecture execution layer, utilizing user-mode emulation to run binaries and containers built for