Projects sharing features with Lxc Lxd

mergerfs is a FUSE-based union filesystem that pools multiple independent filesystems or directories into a single unified mount point. It acts as a proxy to underlying storage, forwarding file operations directly to the filesystem for near-native performance while merging directory listings and attribute changes. The project provides a live, read-write pooled view of storage that aggregates drives of any size without requiring reformatting or data redistribution, and it isolates individual drive failures so that the pool continues serving data from remaining filesystems. The filesystem offer

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

GlusterFS is a software-defined distributed file system and scale-out storage cluster that aggregates disk resources from multiple servers into a single global namespace. It functions as a unified storage platform, allowing the same underlying data to be exposed through file, block, and object storage interfaces. The system distinguishes itself through a decentralized architecture that uses consistent hashing to distribute files across network nodes without a central metadata server. It ensures data integrity and availability using self-healing replication, quorum-based consistency to prevent

LiteFS is a FUSE-based distributed file system designed to replicate SQLite databases across a cluster of machines. It functions as a high availability layer that synchronizes data by intercepting write operations to ensure consistency across multiple server nodes. The system manages distributed database storage by mapping file operations to network requests via a user-space driver. This allows for multi-region data synchronization and the distribution of database content to edge nodes, facilitating local reads with synchronized global writes. The replication process utilizes write-ahead log

ZFS is an enterprise-grade file system and logical volume manager that integrates storage pooling with advanced data protection. It functions as a storage engine that aggregates multiple physical devices into a unified resource pool, allowing for the dynamic allocation of capacity across individual file systems. The system utilizes a transactional, copy-on-write architecture that ensures file system consistency through intent logging and atomic operations. It maintains data integrity by organizing blocks into a hierarchical tree structure, where cryptographic checksums are used to detect and

Maybe is a command execution simulator and filesystem operation auditor. It provides a dry-run environment that records intended file changes without performing actual write operations to the disk and acts as a security layer to block unauthorized modifications. The tool intercepts system calls to preview and approve filesystem modifications before they are committed. It utilizes a user-approval execution loop that pauses program execution until a user consents to pending system operations. The system covers command execution previews, filesystem operation auditing, and system call filtering

Aurae is a memory-safe distributed systems runtime daemon written in Rust that acts as a container and process orchestrator. It manages and schedules workloads, containers, and virtual machines across distributed infrastructure nodes using remote procedure calls and isolated kernel-level boundaries. The platform provides a mutual transport-layer security gateway that enforces cryptographic identity and socket-level authentication across distributed infrastructure. It includes enterprise workload isolation features to secure control planes and manage multi-tenant processes on host operating sy

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard. The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for ex

Youki is an OCI container runtime written in Rust. It implements the Open Container Initiative runtime specification to manage the lifecycle of containerized processes and ensure compatibility with standard container images and engines. The runtime is designed for memory safety and supports rootless container execution, allowing containers to run as non-root users to reduce security risks and limit privilege escalation. It provides core container management capabilities, including spawning and managing OCI containers. This is achieved through Linux namespace isolation, cgroup-based resource

OrbStack is a native macOS application that replaces Docker Desktop, providing an all-in-one environment for running Docker containers, full Linux virtual machines, and local Kubernetes clusters. It runs Linux VMs directly on the macOS hypervisor framework for near-native performance, uses VirtioFS for fast bidirectional file sharing between macOS and Linux, and leverages Rosetta for near-native x86 emulation on Apple Silicon. The system assigns predictable local domain names to containers and VMs with automatic HTTPS certificate generation, forwards ports via event-driven updates, and stores

Run-in-Sandbox is a sandbox automation utility that provides a right-click shell extension for Windows Explorer, allowing users to launch executables, scripts, installers, and compressed archives directly inside an isolated Windows Sandbox environment. It automates directory mapping, execution commands, and configuration generation to test software without requiring manual setup. The project integrates with the operating system desktop context menu to trigger ephemeral virtualized desktop sessions on demand. It features dynamic tool downloading to fetch required extraction utilities and helpe

Box64 is a cross-architecture runtime and user-mode emulation layer that allows Linux and Windows software to run on non-native hardware. It functions as an x86-64 instruction emulator and binary translator, executing 64-bit binaries on different CPU architectures by translating machine code into native instructions. The project utilizes dynamic recompilation to accelerate execution and maps guest system calls to native host libraries to increase speed and hardware compatibility. It can simulate a 32-bit execution environment to support legacy software and integrates with the operating system

Glider is a multi-protocol forward proxy, transparent proxy gateway, and network service provider. It functions as a DNS and DHCP server, a Linux IP set manager, and a network traffic load balancer. The project distinguishes itself through a protocol-translation bridge that translates traffic between different proxy schemes and a chain-based routing system that sequences multiple remote proxy servers. It supports transparent traffic interception at the system level and utilizes build-time protocol stripping to minimize the binary size of the executable. The system covers a broad range of net

This project is a technical setup guide for installing and configuring Docker within a Windows Subsystem for Linux 2 environment. It serves as a walkthrough for creating a virtualized Linux workspace on Windows to build and run software with native performance. The guide focuses on integrating container engines for isolated application deployment and establishing a cross-platform workflow. It provides instructions for linking external code editors to the subsystem, running graphical Linux applications on the host, and executing host binaries within the Linux terminal. It covers the managemen

This project is a Node.js binary distribution repository and Linux package repository. It provides a hosted set of pre-compiled JavaScript runtime binaries for various Linux distributions to simplify installation and version management through native package managers. The project includes a Node.js observability toolset and security policy manager. These components enable the gathering of runtime telemetry to monitor application health and performance via diagnostic dashboards, while providing a resource restriction layer that intercepts system calls to prevent unauthorized modules from acces

Duplicacy is a cross-platform, deduplicated backup tool that stores encrypted snapshots to local disks and cloud storage services. It operates through both a command-line executable and a web-based graphical interface, enabling backup, restore, and repository management in scripts or through a browser. The software splits files into variable-size chunks identified by their hash, enabling cross-machine deduplication without a central database or chunk index. Each backup creates an immutable snapshot that stores file metadata and chunk references, supporting incremental updates and point-in-tim

Boot2Docker is a minimal Linux distribution that boots entirely from RAM to turn any machine into a Docker host. It is delivered as a bootable ISO image that can be written to SD cards, USB sticks, or hard disks, starting Docker containers in about five seconds without requiring a full operating system installation. The system is preconfigured for use as a VirtualBox virtual machine, with persistent disk mounting that automatically stores Docker images, containers, volumes, and SSH keys across restarts. It supports host-to-container file sharing through VirtualBox Guest Additions integration,

Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc

This project is an orchestration tool for establishing interactive debug sessions within automation pipelines. It functions as a GitHub Action that opens an interactive SSH or web-based shell session, providing a remote access utility for real-time system interaction and troubleshooting during continuous integration execution. The tool supports conditional debugging workflows, allowing interactive shells to be triggered only upon manual request or the failure of previous automation steps. It also enables detached debugging modes to start background sessions that provide connection details wit

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Toolbox is a development workspace orchestrator and container environment manager that bootstraps mutable toolsets and SDKs inside containers. It functions as a Linux distribution sandbox and a host-integrated container runtime, allowing users to run native package managers and software without modifying the host operating system. The project differentiates itself by bridging isolated containers with the host system through the mapping of user identities, network sockets, and home directories. It utilizes a daemonless engine to provide these environments while ensuring that system configurati

Autobase is a self-hosted database-as-a-service platform designed to automate the deployment, scaling, and administration of high-availability PostgreSQL clusters. It functions as a cluster orchestrator that handles replication, failover, and version upgrades across multiple servers. The platform is distinguished by its GitOps-driven approach, using version control and CI/CD pipelines as the single source of truth to automate database configurations and deployments. It provides both a web-based management interface and a command-line tool for provisioning and monitoring clusters. The system

Fastsocket is a high-performance Linux socket implementation designed for linear scalability on multicore systems. It functions as a TCP throughput optimizer and a multicore packet steering engine that reduces system call overhead and lock contention to increase total network processing capacity. The project distinguishes itself through a network system call interceptor that uses a shared library to redirect standard socket calls to optimized interfaces without requiring changes to application binaries. It employs active connection steering by encoding CPU core IDs into source ports and utili

Sanoid is a policy-driven tool for ZFS backup automation, snapshot management, dataset replication, and storage monitoring. It manages the automated lifecycle of filesystem snapshots by translating configurable retention policies into specific creation and pruning commands. The tool provides asynchronous incremental replication of datasets between local or remote hosts using secure tunnels. It differentiates itself by using a structured configuration system to apply standardized snapshot policies across nested filesystem hierarchies through recursive dataset traversal. The software covers st

dqlite is a distributed SQL database that embeds a relational database engine to provide replicated storage across a cluster of nodes. It functions as a replicated SQL engine designed to ensure data remains available and consistent during node failures. The system utilizes a consensus algorithm to manage leader election and synchronize a replicated log across the cluster. This approach enables automatic cluster failover and leader promotion to maintain continuous service without manual intervention. The project covers state machine replication, network-based cluster membership, and transacti

This project is a Linux WiFi hotspot manager that provides a graphical user interface and command-line tools for creating wireless access points and sharing internet connections. It functions as a network interface sharer and access point controller, distributing connectivity from any network interface to wireless clients. The software distinguishes itself by including a VPN traffic router that tunnels hotspot traffic through a virtual network interface to provide secure connectivity. It also features a utility to generate QR codes for sharing connection details, allowing devices to join the

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte