Projects sharing features with Runtime

Asterinas is a memory-safe operating system kernel designed to prevent data races and memory corruption. It functions as a Linux-ABI compatible kernel, enabling the execution of existing Linux binaries and container workloads while providing a declarative operating system distribution model. The project distinguishes itself by acting as a virtual machine container host and a confidential computing guest OS, allowing it to run within hardware-isolated Trusted Execution Environments such as Intel TDX. It implements a minimal trusted computing base by isolating unsafe low-level operations and se

Containerd is a daemon-based container runtime that manages the complete lifecycle of containers on a host system. It functions as a core orchestration backend, handling image distribution, storage, and process execution while adhering to industry-standard specifications for container execution and configuration. The project is distinguished by its modular, plugin-based architecture, which allows for the extension of storage, runtime, and networking capabilities without requiring a full daemon recompile. It utilizes a shim-based execution model to delegate low-level operations, ensuring isola

Finch is a virtual machine-based container runtime and OCI container management CLI used for local container development. It operates by running container workloads inside a background virtual machine to isolate them from the host operating system. The project serves as an OCI image builder and a multi-container service orchestrator for simulating complex production environments on a workstation. The runtime functions as a cross-platform container engine, utilizing emulation layers to execute container images built for foreign CPU architectures. It distinguishes its image distribution through

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

OpenSandbox is a secure sandbox runtime and containerized code execution engine designed to run AI-generated code and scripts in isolated environments. It serves as a workload orchestrator that prevents host system contamination by utilizing kernel-level isolation to execute arbitrary commands and scripts. The project distinguishes itself by providing a model context server that bridges large language models to the sandbox for performing file operations and system commands. It also includes a remote GUI sandbox that supports browser automation and desktop interfaces via remote access protocol

microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr

microvm.nix is a declarative virtual machine manager and orchestrator for defining, building, and managing isolated guest environments using Nix. It functions as a virtual machine image builder that transforms system specifications into bootable disk images and runner scripts. The project provides a hypervisor abstraction layer, enabling the deployment of guest images across multiple virtualization backends through a unified configuration. It includes specialized tools for PCI hardware passthrough, granting virtual machines direct access to physical host USB and PCI devices. The framework co

This project is a distributed computing platform designed to orchestrate containerized workloads across heterogeneous hardware clusters. It functions as a centralized control plane that manages resource allocation, scheduling, and execution environments, enabling organizations to share high-performance computing infrastructure securely among multiple users and projects. The platform distinguishes itself through advanced hardware virtualization and multi-tenant management capabilities. It supports the partitioning of physical graphics processing units into fractional slices, allowing multiple

This project is a comprehensive educational resource and curriculum focused on site reliability engineering, distributed systems, and infrastructure operations. It provides technical guides, a systems engineering course, and instructional manuals designed to teach the principles of managing large-scale computing environments. The curriculum covers high-level architectural design for scalability and resilience, including fault-tolerant infrastructure, high-availability patterns, and microservices decomposition. It emphasizes the practical application of site reliability engineering through the

virt-manager is a graphical management interface for configuring hypervisors, virtual machine instances, and containers via the libvirt API. It provides a desktop environment for managing KVM-based virtualization on Linux hosts, acting as a centralized controller for both local and remote hypervisors. The project distinguishes itself through integrated management of the surrounding virtualization infrastructure. It includes dedicated interfaces for virtual network administration to connect guests to physical hardware and virtual storage management for organizing disk volumes into logical pool

Virtual-dsm is a virtualization platform that enables the execution of full virtual machine environments within containers. By leveraging kernel-level virtualization and hardware-assisted extensions, it allows virtual instances to run with near-native performance while maintaining resource isolation on the host system. The project distinguishes itself by facilitating the deployment of specialized operating systems, such as network-attached storage environments, directly within containerized instances. It provides granular control over hardware integration, allowing users to map physical host

Cloud Hypervisor is a Rust-based hypervisor and KVM virtual machine monitor designed to execute 64-bit guest operating systems. It functions as a user-space virtual machine manager that employs a minimal emulation layer to reduce memory overhead and latency for cloud workloads. The project distinguishes itself through the use of a memory-safe language to implement a virtio device emulator and a user-space device model. It provides a standardized web API for managing virtual machine lifecycles and resource configurations. The platform covers broad virtualization capabilities, including the em

Dangerzone is a security tool and content sanitizer that converts untrusted files into safe PDFs. It removes malicious content by rendering documents as raw pixels within a sandboxed environment and rebuilding them as new PDF files to strip executable scripts and hidden threats. The project utilizes container-based sandboxing to isolate file processing from the host operating system. It is designed for air-gapped execution, allowing the sanitization process to operate on hardware without network connectivity to prevent malware from communicating with external servers. To maintain document ut

rkt is a secure Linux container engine and pod-native container manager. It provides a composable execution environment for launching and managing isolated application containers on Linux, serving as a runtime designed around open industry standards for image formats and networking interfaces. The system is distinguished by a pod-native execution model that groups multiple containers and shared resources into single, self-contained units. It utilizes pluggable execution engines to provide secure isolation, including the use of hardware-based virtualization to create security boundaries betwee

LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile

Hyperlight is an embedded virtual machine manager designed to execute guest binaries within hardware-isolated code sandboxes. It utilizes a KVM micro-VM manager to run untrusted third-party code, enforcing strict memory boundaries to prevent unauthorized host access. The project features a guest-host function bridge that facilitates bidirectional communication and a state snapshot tool for saving and restoring the memory state of a sandbox to reduce startup latency. The system includes a toolchain for guest binary cross-compilation and mechanisms for managing resource constraints, such as fi

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

Nomad is a distributed workload orchestrator and infrastructure automation platform designed to manage the lifecycle of applications across large-scale, heterogeneous environments. It functions as a multi-cloud orchestration engine, providing a unified control plane to deploy, scale, and govern containers, virtual machines, and legacy applications. By utilizing declarative job specifications, the system ensures infrastructure convergence and maintains the desired state across distributed data centers and geographic regions. The platform distinguishes itself through a flexible, plugin-based ar

This project is a cybersecurity educational resource and courseware designed for malware analysis and reverse engineering. It provides a structured curriculum of lessons, labs, and guided projects focused on detecting and understanding the behavior of malicious software. The resource includes a lab guide for building isolated virtual machine environments to safely execute and study malware. It covers the setup of a specialized toolchain consisting of disassemblers and debuggers used to analyze compiled machine code. The training material covers both static analysis, which examines binary cod

Docker-OSX is a containerized virtualization platform that enables the execution of full operating systems within isolated environments. By leveraging hardware-accelerated hypervisors and machine emulation, the project allows guest operating systems to run with near-native performance, effectively mimicking dedicated physical hardware within a container. The platform distinguishes itself by providing a complete infrastructure for remote desktop and headless management, allowing users to interact with virtualized graphical environments over network protocols. It supports advanced hardware inte

This project provides a containerized environment for running a full macOS desktop operating system. It utilizes a hardware-accelerated virtualization engine to execute the guest environment, allowing for the deployment and management of virtual machines through standard container orchestration tools. The platform distinguishes itself by enabling direct hardware passthrough, which maps physical host disks, partitions, and USB controllers directly into the virtual machine for native driver access. It also supports advanced network integration, allowing the guest system to obtain its own unique

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

KubeEdge is a distributed edge computing framework that extends Kubernetes to manage containerized workloads and hardware devices at the edge. It functions as a Kubernetes edge orchestration system, allowing the deployment and management of applications across distributed edge nodes using native Kubernetes APIs and workflows. The project distinguishes itself through a specialized focus on IoT integration and node autonomy. It employs digital-twin state modeling to represent physical hardware devices as virtual objects, utilizing an MQTT-based messaging bus for communication with heterogeneous

Kuboard-press is a visual management interface for Kubernetes clusters that enables the orchestration of workloads and system objects without manual text file editing. It provides a centralized dashboard for importing and monitoring multiple clusters, using a visual interface to manage namespaces and containerized workloads. The project differentiates itself through hierarchical microservices visualization, which maps flat cluster workloads into a layered structure to represent architectural relationships. It also includes dedicated container operation tools for accessing logs, opening intera

This project is an Android container runtime that enables the deployment of GPU-accelerated Android instances on Linux hosts across multiple hardware architectures. It provides a cloud-based environment for virtualized Android devices, functioning as a containerized implementation of the Android operating system to support scalable device instances. The system distinguishes itself through a cross-architecture runtime capable of executing ARM-based Android applications on x86 hardware via binary translation layers. It further utilizes host GPU resources to provide high-performance graphics ren

Kruise is a workload management system designed for large-scale applications on Kubernetes. It provides a framework for advanced orchestration, scaling, and upgrade strategies to maintain stability in massive deployments. The project is distinguished by its ability to perform in-place updates of container images and resource limits without deleting and recreating pods. It includes a dedicated image pre-puller to accelerate pod startup and a sidecar injector to dynamically manage the lifecycle of sidecar containers. Additionally, a resource distributor synchronizes configuration maps and secre