Awesome GitHub RepositoriesUID/GID Remapping

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

mergerfs is a FUSE-based union filesystem that pools multiple independent filesystems or directories into a single unified mount point. It acts as a proxy to underlying storage, forwarding file operations directly to the filesystem for near-native performance while merging directory listings and attribute changes. The project provides a live, read-write pooled view of storage that aggregates drives of any size without requiring reformatting or data redistribution, and it isolates individual drive failures so that the pool continues serving data from remaining filesystems. The filesystem offer

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

LXC, एक OS-लेवल वर्चुअलाइजेशन फ्रेमवर्क और Linux कंटेनर मैनेजर है जिसका उपयोग एक ही होस्ट पर कई आइसोलेटेड Linux सिस्टम चलाने के लिए किया जाता है। यह एक कर्नल नेमस्पेस ऑर्केस्ट्रेटर और अनप्रिविलेज्ड कंटेनर रनटाइम के रूप में काम करता है, जो हाइपरवाइज़र के ओवरहेड के बिना सिस्टम कंटेनर्स के निर्माण और प्रबंधन की अनुमति देता है। प्रोजेक्ट होस्ट सिस्टम एक्सेस को रोकने के लिए कंटेनर रूट यूज़र्स को अनप्रिविलेज्ड होस्ट यूज़र्स से मैप करके अनप्रिविलेज्ड कंटेनर निष्पादन प्रदान करता है। यह सिस्टम कॉल फ़िल्टरिंग और रूट यूज़र आइसोलेशन के माध्यम से सुरक्षा सुनिश्चित करता है, जिससे कंटेनर्स को होस्ट रूट विशेषाधिकारों की आवश्यकता के बिना चलने में सक्षम बनाया जाता है। फ्रेमवर्क CPU और मेमोरी उपयोग को सीमित करने के लिए कंट्रोल ग्रुप्स का उपयोग करके रिसोर्स आइसोलेशन को मैनेज करता है और प्रोसेस व नेटवर्क आइसोलेशन के लिए कर्नल नेमस्पेस का उपयोग करता है।

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

This project provides containerized distribution templates and images for deploying a media server. It enables the operation of a media server within Docker or Kubernetes environments, utilizing package management charts to streamline installation and management of home cinema libraries. The project focuses on high-performance video processing through hardware accelerated transcoding, which is achieved by passing through graphics processing unit devices to the container. It ensures data persistence by mapping host directories for configuration databases and large-scale media libraries. The s

The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning. The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo