Sysbox

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning.

The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker workflows, and uses shiftfs overlay filesystem for shared filesystem access between host and container namespaces. Sysbox also integrates OCI runtime hooks to configure namespaces, cgroups, and mounts at container lifecycle events.

The project provides capabilities for partitioning bare-metal or cloud instances into multiple isolated compute environments with higher density than virtual machines, and for replacing virtual machines with faster, more portable containers for running legacy applications and multi-service workloads. Documentation and installation instructions are available through the project's repository.

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Star history

How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.

nestyboxsysbox

Name: nestybox/sysbox
Author: nestybox

View on GitHub

3,458 stars201 forksShellapache-2.015 views

Sysbox

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Open-source alternatives to Sysbox

Similar open-source projects, ranked by how many features they share with Sysbox.

opencontainers/runtime-spec
opencontainers/runtime-spec
3,641View on GitHub
The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and
Gocontainersdockeroci
View on GitHub3,641
lxc/lxc
lxc/lxc
5,204View on GitHub
LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile
C
View on GitHub5,204
opencontainers/runc
opencontainers/runc
13,067View on GitHub
runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container Initiative specification. It serves as a low-level container execution engine that interfaces directly with the host operating system to manage the lifecycle of isolated processes. The tool functions as a Linux process containerizer, utilizing kernel features such as namespaces for process isolation and control groups for resource governance. It enforces security by restricting processes to specific directory trees and dropping unnecessary kernel privileges to minimize the attac
Gocontainersdockeroci
View on GitHub13,067

Frequently asked questions

What does nestybox/sysbox do?

What are the main features of nestybox/sysbox?

The main features of nestybox/sysbox are: VM-Like Isolation Runtimes, Container, ID-Shifting, Repository-Built Container Hook Runs, System Software Container Runs, System Software Container Execution, Docker-in-Docker Runtimes, Inner Container Deployments.

What are some open-source alternatives to nestybox/sysbox?

Open-source alternatives to nestybox/sysbox include: opencontainers/runtime-spec — The project provides an open container runtime specification and standardized schema for defining container… lxc/lxc — LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on… opencontainers/runc — runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container… lxc/incus — Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual… containers/bubblewrap — Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted… actions/actions-runner-controller — Kubernetes controller for GitHub Actions self-hosted runners.