Projects sharing features with X11docker

Bubblewrap is an unprivileged sandbox execution utility for Linux that isolates processes from the host system. It creates secure environments by leveraging Linux namespaces to separate system resources, including network, PID, and IPC stacks. The project distinguishes itself by enabling the execution of untrusted software without requiring root privileges on the host machine. It prevents privilege escalation by disabling the execution of setuid binaries and uses user identity mapping to isolate process permissions from the host operating system. The tool manages a comprehensive security sur

xhyve is a macOS virtual machine manager and virtualization tool that leverages the native hypervisor framework to run guest operating systems in userspace. It provides a virtualization layer for executing guest systems with hardware acceleration. The project features a hardware pass-through hypervisor that maps physical host devices directly to guest virtual machines to increase performance. It includes a remote framebuffer server and VNC access to enable interaction with the guest display and input devices from external devices. The tool covers virtual hardware emulation for storage, netwo

This project is an X11 window system server that coordinates graphical output and input devices. It functions as a display server, a hardware driver manager for graphics and input modules, and a graphics server capable of rendering directly to a generic framebuffer. The server provides multi-seat display management to isolate input and display devices for different concurrent users. It also implements namespace isolation to separate clients and restrict resource access, preventing interference between different user sessions or processes. The system manages GPU driver integration through dyn

Cloud Hypervisor is a Rust-based hypervisor and KVM virtual machine monitor designed to execute 64-bit guest operating systems. It functions as a user-space virtual machine manager that employs a minimal emulation layer to reduce memory overhead and latency for cloud workloads. The project distinguishes itself through the use of a memory-safe language to implement a virtio device emulator and a user-space device model. It provides a standardized web API for managing virtual machine lifecycles and resource configurations. The platform covers broad virtualization capabilities, including the em

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

Toolbox is a development workspace orchestrator and container environment manager that bootstraps mutable toolsets and SDKs inside containers. It functions as a Linux distribution sandbox and a host-integrated container runtime, allowing users to run native package managers and software without modifying the host operating system. The project differentiates itself by bridging isolated containers with the host system through the mapping of user identities, network sockets, and home directories. It utilizes a daemonless engine to provide these environments while ensuring that system configurati

This project is an Android container runtime that enables the deployment of GPU-accelerated Android instances on Linux hosts across multiple hardware architectures. It provides a cloud-based environment for virtualized Android devices, functioning as a containerized implementation of the Android operating system to support scalable device instances. The system distinguishes itself through a cross-architecture runtime capable of executing ARM-based Android applications on x86 hardware via binary translation layers. It further utilizes host GPU resources to provide high-performance graphics ren

Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi

s6-overlay is a container init system and process orchestrator. It provides a specialized script environment and a process supervisor to coordinate boot sequences, manage background daemons, and handle read-only filesystems within containers. The project distinguishes itself by using an execline shell environment to avoid the overhead of traditional shell interpreters. It includes a dedicated manager to redirect write operations to temporary memory mounts for containers with read-only root filesystems. The system covers service lifecycle orchestration, including dependency-based startup and

KasmVNC is a web-based VNC server and remote access solution that provides a secure gateway for accessing remote desktop environments through a web browser. It implements the Remote Frame Buffer protocol to transmit pixel data and serves as a secure remote access gateway with integrated user auditing and input controls. The project distinguishes itself through extensive hardware acceleration, using GPU-accelerated frame capture and graphics acceleration to support graphics-intensive tasks with low latency. It employs a multi-threaded compression pipeline and dynamic encoding negotiation to ma

This project is a containerized Linux desktop streamer that renders a full operating system interface in a web browser using encoded video streams. It allows for remote access to various Linux distributions and serves as a platform for browser-based application hosting. The system supports GPU acceleration via KVM and direct hardware passthrough to enable low-latency graphics rendering and video encoding. It also features volume mapping for home directory persistence, ensuring that user data and portable applications survive environment updates. Additional capabilities include the creation o

noVNC is an HTML5 remote desktop viewer and VNC web client that allows users to access and control remote desktops, virtual machines, and containers through a web browser. It functions as a remote desktop management tool that integrates the VNC protocol to enable remote server administration without the need for a dedicated client application. The project includes a VNC WebSocket proxy that translates binary VNC network traffic into WebSockets to bypass browser restrictions on direct TCP connections. This proxy service supports bridging connections to multiple remote servers by listening on v

mergerfs is a FUSE-based union filesystem that pools multiple independent filesystems or directories into a single unified mount point. It acts as a proxy to underlying storage, forwarding file operations directly to the filesystem for near-native performance while merging directory listings and attribute changes. The project provides a live, read-write pooled view of storage that aggregates drives of any size without requiring reformatting or data redistribution, and it isolates individual drive failures so that the pool continues serving data from remaining filesystems. The filesystem offer

microvm.nix is a declarative virtual machine manager and orchestrator for defining, building, and managing isolated guest environments using Nix. It functions as a virtual machine image builder that transforms system specifications into bootable disk images and runner scripts. The project provides a hypervisor abstraction layer, enabling the deployment of guest images across multiple virtualization backends through a unified configuration. It includes specialized tools for PCI hardware passthrough, granting virtual machines direct access to physical host USB and PCI devices. The framework co

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

termux-x11 is an X11 display server and graphical interface layer for Android that enables the execution of Linux desktop environments and graphical applications. It functions as an input emulator and display server, translating X11 protocol requests into graphical output on mobile hardware. The project features a coordination layer for integrating isolated proot or chroot containers by sharing temporary directories and configuration paths. It also includes an input translation system that maps mobile touch gestures and multi-finger taps into standard X11 mouse clicks and scroll events. The

AdrenoToolsDrivers is a collection of compiled graphics drivers and hardware accelerators for Adreno GPUs. These driver binaries enable hardware acceleration for virtualized Android devices, allowing emulators to leverage the native GPU hardware of compatible devices to improve visual rendering performance and stability. The project focuses on Android emulator optimization by providing compatible drivers for software such as Yuzu and Vita3K. By managing and configuring these specific GPU drivers, the project aims to improve frame rates and overall stability for emulated applications on Androi

Anbox is an Android container environment and runtime designed to execute Android applications on Linux desktops. It utilizes a container-based system to run the Android operating system without the overhead associated with traditional hardware virtualization. The system features a hardware abstraction layer that routes hardware access and sensor data through a host daemon to provide accelerated rendering. It integrates with the Linux desktop by mapping individual Android application layers to separate windows, allowing apps to function as distinct desktop applications. The project supports

Flatpak is a sandboxed application framework and standardized packaging format for Linux desktop applications. It functions as a distribution system that allows a single application bundle to run consistently across multiple Linux operating systems without requiring per-distribution builds. The project provides a runtime dependency manager that bundles specific library versions or shared runtimes to create predictable execution environments. It includes a sandbox permission manager to control application access to system hardware and resources, ensuring security and consistent behavior betwee

This project is an open source Linux GPU kernel driver implemented as a loadable kernel module. It functions as a GPU firmware loader, providing the low-level driver services necessary to enable direct communication between the operating system and graphics processing units. The driver utilizes a dual-module architecture that separates GPL-licensed kernel code from proprietary firmware blobs. This system extracts and links signed binary firmware images into the kernel modules at driver load time. The project provides driver support for Turing-architecture GPUs and all subsequent newer hardwa

This project is a cross-platform rendering engine and Dart runtime embedder. It functions as a hardware-accelerated graphics engine that composites and paints user interfaces across mobile, desktop, and web targets. The engine utilizes a hardware-accelerated rendering pipeline to drive high-frame-rate animations using GPU APIs such as Vulkan, Metal, and OpenGL. It incorporates an accessibility framework that maps user interface semantics to platform assistive technologies and screen readers. The system provides a platform abstraction layer for managing file and network I/O and incorporates a

Isolate is a low-level sandbox designed to execute untrusted programs within a strictly controlled environment. It functions as a process isolation engine that prevents potentially harmful code from interacting with or damaging the host operating system. The tool leverages Linux kernel primitives, including namespaces and control groups, to partition system resources and enforce hardware usage boundaries. By applying filesystem virtualization and system call filtering, it restricts the visibility and interaction of a process with the host, ensuring that untrusted applications operate only wit

Xilem is a native user interface framework for the Rust programming language. It provides a reactive view tree that links application state to the interface to automate updates when data changes. The framework incorporates a GPU-accelerated 2D graphics engine and a dedicated text layout engine to handle complex typography and high-performance visual rendering. It is built as an accessible UI framework with integrated support for system accessibility services and screen readers. The system utilizes a retained-mode architecture with a graphics pipeline that translates drawing commands into har

Crouton is a tool that creates and manages full Linux distribution environments that run alongside Chrome OS using chroot technology, without requiring a reboot or dual-boot setup. It shares the host kernel to avoid virtualisation overhead while providing a complete Linux filesystem that operates concurrently with the Chromium OS desktop. The project supports encrypting chroot environments with decryption keys that can be stored on a separate removable device, requiring physical possession to unlock the environment. It enables graphical Linux applications to display inside a Chrome OS window

SmartSub is a cross-platform desktop application for AI-driven video transcription and subtitle generation. It converts audio and video files into text subtitles using local AI models and incorporates hardware acceleration to increase processing speed. The tool features a subtitle translator that leverages large language models, such as OpenAI and DeepSeek, to convert subtitles between different languages. It includes a visual editor for proofreading and polishing transcribed text, paired with a video preview for frame-accurate synchronization. The software supports batch processing of multi

This project is a hardware-accelerated transcription server and offline subtitle generator. It functions as a speech-to-text tool that converts audio and video files into plain text, JSON, and SRT subtitle formats using the Whisper model. The system operates as an OpenAI Audio API emulator, providing a local server that mimics a specific audio interface. This allows it to serve transcriptions to existing client configurations without requiring changes to the client software. The service utilizes GPU acceleration to increase voice recognition speed and includes utilities for hardware detectio