Projects sharing features with Flatpak

This project is a Node.js binary distribution repository and Linux package repository. It provides a hosted set of pre-compiled JavaScript runtime binaries for various Linux distributions to simplify installation and version management through native package managers. The project includes a Node.js observability toolset and security policy manager. These components enable the gathering of runtime telemetry to monitor application health and performance via diagnostic dashboards, while providing a resource restriction layer that intercepts system calls to prevent unauthorized modules from acces

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

This project is a reference implementation and tutorial designed to demonstrate the end-to-end workflow of building, versioning, and uploading Python distributions. It serves as a concrete project template and example for configuring metadata and build artifacts for package indices. The repository illustrates how to package software by defining project metadata and dependencies in static configuration files. It covers the process of transforming source trees into versioned archives and platform-specific binary distributions, specifically showing how to build binary wheels and source distribut

This project is a Linux game distribution client, digital game storefront, and gaming runtime. It provides a desktop interface for discovering, purchasing, downloading, and launching digital video games on Linux operating systems. The software implements a translation layer that converts Windows API calls into Linux system calls to enable the execution of non-native binaries. It utilizes a container-based runtime environment and kernel namespaces to ensure binary and dependency compatibility across diverse Linux distributions. The system includes a display manager that abstracts the interfac

Isolate is a low-level sandbox designed to execute untrusted programs within a strictly controlled environment. It functions as a process isolation engine that prevents potentially harmful code from interacting with or damaging the host operating system. The tool leverages Linux kernel primitives, including namespaces and control groups, to partition system resources and enforce hardware usage boundaries. By applying filesystem virtualization and system call filtering, it restricts the visibility and interaction of a process with the host, ensuring that untrusted applications operate only wit

Dify-sandbox is a secure runtime environment designed for the execution of untrusted code snippets. It functions as a containerized sandbox that isolates processes from the host operating system, ensuring that arbitrary scripts can be run without granting them unauthorized access to sensitive data or critical system resources. The project distinguishes itself through a multi-layered security approach that combines kernel-level isolation with strict resource management. By utilizing Linux namespaces and container-based process isolation, it partitions system resources to maintain visibility bo

Helm is a package manager for Kubernetes that simplifies the deployment and management of multi-component applications. It functions as a template rendering engine and release coordinator, allowing users to bundle, version, and deploy software as standardized packages. By maintaining a persistent metadata layer within the cluster, it tracks release history and manages the full lifecycle of applications, including installations, upgrades, and rollbacks. What distinguishes Helm is its ability to handle complex application hierarchies through automated dependency resolution and the composition o

Wasmer is a high-performance runtime engine designed to execute sandboxed WebAssembly modules across server-side, edge, and browser environments. It functions as a comprehensive platform for building, distributing, and running isolated applications, providing a secure and portable execution layer that maintains consistency across diverse hardware architectures and operating systems. The platform distinguishes itself through a robust toolchain that enables cross-language interoperability and the transformation of code into portable binary packages. It supports ahead-of-time binary generation t

Miniforge is a minimal installer for the Conda package management system that provides access to community-maintained software channels. It serves as a lightweight tool for setting up isolated software environments and distributing pre-compiled binary packages to ensure cross-platform compatibility. The project enables the installation of a minimal environment and facilitates the migration of package channels from vendor repositories to community-driven distributions. It allows users to retrieve and manage software packages built by a community to extend the available tools in a local environ

Entropic is a language-agnostic package registry and distribution system that uses content-addressable storage to host and version software packages across a network of mirrors. It functions as both a private package registry and a JavaScript package manager, identifying assets by cryptographic hashes rather than file paths. The system focuses on reliable distribution through private package mirrors that cache and sync remote dependencies to prevent installation failures during external downtime. It includes a version manager for assigning distribution tags and controlling the software releas

Conan is a package manager and binary repository for C and C++ that resolves and installs external libraries to ensure consistent build environments across different platforms. It functions as a native dependency resolver and a cross-platform build tool designed to facilitate reproducible native builds. The project provides capabilities for native package hosting, allowing users to implement a server to store and distribute pre-compiled libraries and their required dependencies. It also supports standalone binary bundling to create executable files that include all necessary runtime dependenc

x11docker is an OCI container GUI orchestrator and hardware bridge designed to execute graphical applications and full desktop environments inside containers. It functions as a Linux GUI sandbox, linking containerized processes to host X11 or Wayland display servers and audio systems. The project differentiates itself by providing deep system integration for hardware acceleration, including NVIDIA driver automation and GPU passthrough. It supports cross-architecture GUI emulation and provides remote access capabilities through VNC, SSH forwarding, and browser-based HTML5 rendering. The tool

Swift Package Manager is a cross-platform build tool, dependency resolver, and package distributor. It compiles Swift source code into native executable binaries for multiple operating systems and manages the resolution and linking of external Swift code packages. The tool facilitates Swift package distribution by sharing and distributing reusable source code through public or private channels. It orchestrates Swift projects by managing external code libraries and versioning to ensure consistent builds across different development environments.

Toolbox is a development workspace orchestrator and container environment manager that bootstraps mutable toolsets and SDKs inside containers. It functions as a Linux distribution sandbox and a host-integrated container runtime, allowing users to run native package managers and software without modifying the host operating system. The project differentiates itself by bridging isolated containers with the host system through the mapping of user identities, network sockets, and home directories. It utilizes a daemonless engine to provide these environments while ensuring that system configurati

Sandstorm is an open-source platform that packages and runs web applications in security-hardened sandboxes on a personal server, functioning as a self-hosted web app operating system. It provides a curated app store where users discover and install sandboxed web applications with one-click ease, while each application runs in an isolated container that uses Linux kernel security features to separate it from the host and other apps. The platform includes a centralized authentication layer so users sign in once and gain access to all installed applications without managing separate accounts per

electron-vue is a pre-configured project boilerplate and scaffolding system for building desktop applications using Electron and Vue.js. It provides a standardized project structure and an integrated build pipeline to accelerate the development of desktop software. The project enables a hybrid deployment model, allowing developers to generate both standalone desktop executables for multiple operating systems and browser-compatible web versions from a single codebase. It distinguishes its development workflow with hot reloading and hot module replacement to update the user interface in real-ti

Swift is a high-performance, general-purpose programming language designed for safety and speed. It features a modular compiler front-end that transforms source code into optimized machine binaries, utilizing a value-oriented type system that prioritizes predictable state management through value and reference types. The language is built on a task-based concurrency model that schedules asynchronous operations across multicore hardware to ensure data race safety. The project distinguishes itself through a native, bi-directional interoperability mechanism that allows for direct integration wit

Crossplane is a Kubernetes-based control plane framework that functions as a cloud resource orchestrator and infrastructure-as-code platform. It enables the management of heterogeneous infrastructure by extending the Kubernetes API to provision and maintain external cloud services through declarative configuration. By utilizing custom resource controllers, it continuously reconciles the state of external infrastructure with defined desired states, ensuring consistent deployment and lifecycle management across multiple cloud providers. The platform distinguishes itself through its composition-

The Rust Programming Language Book is the official technical guide and educational resource for the Rust language. It provides a comprehensive walkthrough of the language's design, focusing on its core identity as a systems programming language that enforces memory safety and high-performance execution without the need for a garbage collector. The project is distinguished by its focus on ownership, borrowing, and lifetime tracking, which allow the compiler to verify memory safety and thread safety at compile time. It covers the language's unique approach to zero-cost abstractions, including t

crun is a low-level container runtime that implements the Open Container Initiative specification for managing the lifecycle of isolated processes. It provides the core mechanisms for container creation, execution, and deletion, ensuring compatibility across platforms through standardized lifecycle management. The project distinguishes itself by offering a shared C library that allows container runtime operations to be embedded directly into other compiled applications. It further extends execution capabilities through specialized handlers that enable the deployment of containers within isola

Ninja is a low-level build system and executable designed to function as a backend for higher-level build generators. It serves as a build graph processor that evaluates build files to determine the optimal execution order for target dependencies and binaries. The tool focuses on fast software compilation by executing commands based on dependency graphs to transform source code into binaries. It operates as an incremental build tool, utilizing file timestamps to manage build operations and recompile only the modified parts of a project. The system manages build automation through automated d

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

Docker is an OCI container engine and runtime orchestrator used to build, run, and manage isolated applications. It functions as a container image builder for creating portable snapshots of applications and a registry manager for storing, versioning, and distributing those images across environments. The platform provides a centralized daemon to control the creation, execution, and termination of containerized workloads. It allows for the assembly of modular container systems by combining build tools, registries, and runtimes. Its core capabilities cover container image creation, registry ad

Docker CE is an OCI compliant container platform and runtime engine used for building and running applications within isolated environments. It functions as a Linux container orchestrator and provides a command-line interface to manage the entire lifecycle of running application instances. The platform enables containerized application deployment and cross-platform software distribution by packaging software with its dependencies. It supports microservices architecture management and the creation of reproducible local development environments. The system includes capabilities for application

img is a collection of toolsets for building, managing, and manipulating OCI compliant container images. It functions as an image build tool and registry client, providing the capabilities to create images from configuration files, push and pull images to remote registries, and extract image layers into root filesystems or archives. The project distinguishes itself through support for multi-platform builds using hardware emulators and the ability to perform unprivileged container builds via namespace-based process isolation and user ID mapping. It also includes a cross-platform binary compile

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile