Awesome GitHub RepositoriesUID/GID Remapping

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

mergerfs is a FUSE-based union filesystem that pools multiple independent filesystems or directories into a single unified mount point. It acts as a proxy to underlying storage, forwarding file operations directly to the filesystem for near-native performance while merging directory listings and attribute changes. The project provides a live, read-write pooled view of storage that aggregates drives of any size without requiring reformatting or data redistribution, and it isolates individual drive failures so that the pool continues serving data from remaining filesystems. The filesystem offer

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

LXC es un framework de virtualización a nivel de SO y gestor de contenedores Linux utilizado para ejecutar múltiples sistemas Linux aislados en un solo host. Funciona como un orquestador de espacios de nombres del kernel y tiempo de ejecución de contenedores sin privilegios, permitiendo la creación y gestión de contenedores de sistema sin la sobrecarga de un hipervisor. El proyecto proporciona ejecución de contenedores sin privilegios mapeando los usuarios root del contenedor a usuarios host sin privilegios para prevenir el acceso al sistema host. Asegura la seguridad a través del filtrado de llamadas al sistema y el aislamiento del usuario root, permitiendo que los contenedores se ejecuten sin requerir privilegios de root del host. El framework gestiona el aislamiento de recursos utilizando grupos de control para limitar el uso de CPU y memoria y utiliza espacios de nombres del kernel para el aislamiento de procesos y redes. Incluye capacidades para la administración de puentes de red para prevenir la suplantación de direcciones y una API programática para gestionar el ciclo de vida del contenedor y ejecutar comandos administrativos.

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

This project provides containerized distribution templates and images for deploying a media server. It enables the operation of a media server within Docker or Kubernetes environments, utilizing package management charts to streamline installation and management of home cinema libraries. The project focuses on high-performance video processing through hardware accelerated transcoding, which is achieved by passing through graphics processing unit devices to the container. It ensures data persistence by mapping host directories for configuration databases and large-scale media libraries. The s

The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning. The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo