Open-source alternatives to Nerdctl

Buildx is a BuildKit build extension and container build instance manager that enables the creation of container images targeting multiple CPU architectures and operating systems simultaneously. It functions as a multi-platform image builder that leverages a BuildKit backend to extend standard image building capabilities. The project features a distributed build orchestrator capable of coordinating tasks across a cluster of remote nodes. This allows for native compilation across different hardware architectures by connecting multiple remote workers into a single instance to increase build con

Youki is an OCI container runtime written in Rust. It implements the Open Container Initiative runtime specification to manage the lifecycle of containerized processes and ensure compatibility with standard container images and engines. The runtime is designed for memory safety and supports rootless container execution, allowing containers to run as non-root users to reduce security risks and limit privilege escalation. It provides core container management capabilities, including spawning and managing OCI containers. This is achieved through Linux namespace isolation, cgroup-based resource

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

Kitematic is a graphical user interface for managing and running Docker containers on desktop operating systems. It serves as a visual Docker management tool and API client that translates user interface interactions into REST API calls to control the Docker daemon without requiring the command line. The application is built as a cross-platform Electron desktop application, utilizing a Chromium-based shell to provide a consistent administrative interface across Mac and Windows. The software covers the full container lifecycle, including the creation, configuration, and monitoring of containe

This project is a GitHub Action that automates the building and pushing of Docker container images to OCI registries. It functions as a multi-platform container builder and publisher using the Buildx engine to create images compatible with multiple hardware architectures. The tool distinguishes itself through software supply chain security features, including the generation of software bills of materials and provenance attestations to verify image integrity. It optimizes construction speed via remote cache management and supports secure secret injection to prevent sensitive data from persisti

LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile

Ofelia is a recurring job scheduler designed to run commands inside Docker containers or directly on the host system using a defined timetable. It functions as a configuration engine that reads job schedules and commands from container labels, a concurrency guard to prevent overlapping task executions, and a log router for reporting job outcomes. The system distinguishes itself by using a label-based configuration model, allowing job schedules and execution logic to be defined within container metadata rather than external configuration files. It employs a lock-based concurrency control mecha

Osmedeus is a security workflow orchestration engine that coordinates AI agents, shell commands, and scanning tools through declarative YAML pipelines. It functions as a distributed security scanner, a declarative workflow automator, and an AI agent framework for security, enabling automated multi-step security analysis with conditional branching, parallel execution, and distributed workers. The engine distinguishes itself through a hybrid runner model that executes workflow steps on the local host, inside Docker containers, or over SSH to remote machines, selected per step or module. It supp

This project is a technical setup guide for installing and configuring Docker within a Windows Subsystem for Linux 2 environment. It serves as a walkthrough for creating a virtualized Linux workspace on Windows to build and run software with native performance. The guide focuses on integrating container engines for isolated application deployment and establishing a cross-platform workflow. It provides instructions for linking external code editors to the subsystem, running graphical Linux applications on the host, and executing host binaries within the Linux terminal. It covers the managemen

Libpod is a container management library for running and controlling the lifecycle of Open Container Initiative compliant containers and images across different storage backends. It provides a programmatic interface for the remote control and automation of container environments. The project enables the coordination of multiple containers into pods that share network namespaces and other shared resources. It supports rootless container execution by using user namespaces to launch containers without administrative privileges. The library covers a broad range of system operations, including im

proot-distro is a rootless container runtime and Linux distribution manager that allows users to install and run isolated guest environments without requiring administrative root privileges. It utilizes PRoot to simulate root access and filesystem redirection, enabling the deployment of full Linux distributions in a non-root space. The project functions as an OCI container image handler, capable of building, pulling, and pushing OCI-compatible images and manifests. It further serves as a cross-architecture execution layer, utilizing user-mode emulation to run binaries and containers built for

Outline is a server that manages and runs Shadowsocks proxy instances, each isolated inside its own Docker container, to provide encrypted internet access. It is designed to bypass censorship by routing traffic through secure tunnels that use AEAD cipher encryption and traffic obfuscation to resist detection. Access to the proxy servers is controlled through a REST API that allows administrators to create, list, and revoke cryptographic access keys. The server automates the provisioning and configuration of proxy servers on cloud platforms like DigitalOcean, simplifying deployment through a m

Containerd is a daemon-based container runtime that manages the complete lifecycle of containers on a host system. It functions as a core orchestration backend, handling image distribution, storage, and process execution while adhering to industry-standard specifications for container execution and configuration. The project is distinguished by its modular, plugin-based architecture, which allows for the extension of storage, runtime, and networking capabilities without requiring a full daemon recompile. It utilizes a shim-based execution model to delegate low-level operations, ensuring isola

Dockge is a web-based management interface for containerized applications that utilizes configuration files as the primary source of truth. It provides a centralized dashboard for orchestrating container stacks, allowing users to create, edit, and control services directly through a graphical interface rather than the command line. The platform distinguishes itself by offering a migration utility that converts manual container execution commands into structured configuration files. It supports the management of distributed infrastructure by connecting to multiple remote hosts from a single in

Cosign is a tool for signing and verifying software artifacts, primarily those stored in OCI-compatible registries such as container images, Helm charts, SBOMs, and Tekton bundles. It supports keyless signing using ephemeral keys and short-lived certificates from the Sigstore public-good infrastructure, associating signatures with an OpenID Connect identity rather than a long-lived cryptographic key. The project provides multiple signing and verification methods, including private keys, key pairs stored in KMS providers like AWS KMS and Azure Key Vault, and hardware security keys. It can sign

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

TaskWeaver is an LLM agent framework that interprets natural language requests and executes them as Python code, SQL queries, or shell commands. It functions as a conversational code interpreter that maintains stateful data structures across turns, generating executable code from user prompts within a session-based environment. The system is designed as a self-hosted AI agent platform that can be deployed in Docker, managing sessions and providing a web UI for data analytics and automation tasks. The framework distinguishes itself through a role-based multi-agent architecture that divides the

Komodo is a remote server orchestrator and container deployment platform. It provides a centralized interface for managing multiple remote hosts through lightweight agents, coordinating Docker Swarm and Kubernetes clusters, and automating software delivery via integrated CI/CD pipelines. The system distinguishes itself with a TypeScript-based automation engine that executes typed scripts against the system API for complex operational workflows. It supports infrastructure-as-code through TOML-based declarative configuration synchronization and provides ephemeral build infrastructure that provi

Dockhand is a multi-host Docker manager and container management interface used to control the lifecycle of containers, images, volumes, and networks. It functions as a Docker Compose orchestrator and GitOps deployment tool, enabling the synchronization of application stacks directly from remote Git repositories. The project distinguishes itself as an enterprise Docker access controller, providing role-based access control and identity verification through OIDC, LDAP, and multi-factor authentication. It secures sensitive data using AES-256-GCM encryption for credentials at rest and handles na

Emissary is a Kubernetes API gateway that manages incoming external traffic and routes it to internal microservices. It utilizes an Envoy proxy as the underlying data plane to handle high-performance traffic routing and protocol translation, with a control plane that translates Kubernetes custom resources and annotations into proxy configurations. The project provides specialized support for gRPC infrastructure, including HTTP/2 routing and gRPC-Web protocol bridging for browser-based clients. It enables zero-trust security through mutual TLS encryption and delegates identity verification to

This project is a local Kubernetes cluster manager and tool that runs control plane and worker nodes as containers on a host machine. It provides an environment for local development and automated testing by emulating a full Kubernetes cluster within a container runtime. The tool enables the creation of multi-node topologies and high-availability control planes through configuration files. It supports image sideloading to transfer container images directly from the host to nodes, bypassing remote registries, and allows for offline deployments using pre-built node images. Capabilities include

Cloak is a set of censorship circumvention tools designed for secure proxy tunneling and internet traffic obfuscation. It focuses on bypassing restrictive firewalls and state surveillance by disguising proxy connections as standard web browsing. The project utilizes HTTP fingerprint masquerading to imitate common browser signatures and routes traffic through content delivery networks to mask the identity of the origin server. To further hide the server's purpose, it includes a mechanism to redirect unauthenticated connection requests to a third-party website. The system implements transport

NSLogger is a remote logging framework and binary data logger designed to stream application traces from devices to a dedicated network log viewer. It enables the transmission of system traces over a network, utilizing SSL encryption to ensure secure telemetry transmission. The system distinguishes itself by supporting the embedding of raw binary data and images directly into log streams for visual inspection within the viewer. It also includes an offline log buffer that stores traces locally during network outages and automatically transmits them once connectivity is restored. The framework

Terraforming is an infrastructure as code generator and AWS Terraform resource exporter. It converts live cloud infrastructure into declarative configuration and state files, allowing existing cloud resources to be brought under programmatic management. The tool functions as a state file manager capable of generating and merging JSON state files. It translates live cloud provider API responses into HashiCorp Configuration Language syntax and can integrate newly exported resource data into existing state files without overwriting unrelated entries. The system includes capabilities for resourc

libhv is a high-performance C/C++ network library and event-driven I/O framework used to build TCP, UDP, SSL, HTTP, WebSocket, and MQTT clients and servers. It provides a non-blocking event loop for managing network sockets, timers, and system signals across multiple threads. The project is distinguished by its integrated support for specialized network roles, including a full HTTP web server with RESTful routing and middleware, an MQTT messaging client for IoT communication, and the ability to implement SOCKS5 and HTTP proxies. It also features a reliable UDP implementation to ensure ordered

Plain-app is a multi-purpose toolset for self-hosted device management, providing a web-based dashboard to remotely access files, system settings, and notifications on a mobile device over a local network. It functions as a remote gateway for SMS and notifications, a peer-to-peer file transfer system, and a media server for streaming content to browsers or casting to televisions via DLNA and Chromecast. The project emphasizes secure local connectivity, utilizing TLS and XChaCha20-Poly1305 encryption to protect traffic between the mobile device and the browser. It also includes a distraction-f

Laradock is a collection of pre-configured Docker containers and orchestration definitions used to deploy multi-service development sandboxes. It functions as a PHP runtime manager and a Docker-based development environment, providing a set of modular service definitions for deploying web servers, databases, and caches through a single orchestration file. The project enables the creation of a local ecosystem featuring Nginx, MySQL, Redis, and Elasticsearch to mirror production infrastructure. It allows for switching between different versions of PHP and associated extensions, as well as manag