rkt/rktArchived

Features

• Pod-Native Runtimes - Runs containerized applications as isolated pods on Linux to group related processes with shared networking and resources.
• Image Management - Fetches and executes standardized container images from remote registries while maintaining compatibility with OCI and Docker specifications.
• Cluster Coordination - Coordinates the deployment and scaling of containerized applications across a cluster of machines for high availability.
• Container Runtime Interfaces - Implements the Container Runtime Interface to allow cluster orchestrators to manage container lifecycles.
• Container Runtime Integrations - Acts as a container runtime for cluster orchestration by connecting to the node agent via a standardized API.
• Hypervisor-Based Runtimes - Executes pods within virtual machines using KVM or QEMU for hardware-level isolation.
• OCI Container Engines - Implements the Open Container Initiative standards for building and running containers while maintaining legacy compatibility.
• Overlay Filesystems - Uses overlay filesystems to render container images from content-addressable storage and manage local caches.
• Pod Grouping - Clusters one or more images into a shared execution context with shared networking and resource bounds.
• Pod-Native Container Engines - Provides a runtime for executing containerized applications as isolated pods on Linux systems.
• Container Lifecycle Management - Launches and manages containerized applications as a single unit with configurable networking and storage.
• CNI Implementations - Implements the Container Network Interface specification to manage pod networking and port forwarding.
• Pod Network Orchestration - Sets up private or host networking for pods using CNI plugins and custom DNS settings.
• Linux Container Managers - Leverages low-level Linux kernel features and systemd integration to manage the lifecycle of isolated processes and images.
• QEMU KVM - Executes containers within virtual machines using KVM and QEMU for hardware-level isolation.
• Mandatory Access Control - Utilizes SELinux mandatory access control to assign unique security contexts and prevent unauthorized pod interaction.
• Secure Deployment Practices - Implements SELinux policies and TPM measurement to verify image integrity and enforce mandatory access control for workloads.
• Hardware-Level Isolation - Runs pods within virtual machines to provide a dedicated kernel and hardware-level isolation.
• Lifecycle Integration - Binds container execution to systemd unit files to handle automatic restarts and dependency sequencing.
• Volume Mounts - Attaches host directories or creates empty volumes to provide persistent or temporary storage to pods.
• Remote Image Pulling - Retrieves container images and specific versions from remote registries using content-addressable storage.
• Multi-Specification Support - Loads and executes containers using appc, CNI, Docker, and OCI image specifications.
• Docker Container Execution - Fetches and executes container images created for the Docker ecosystem within a pod-native architecture.
• Distributed Task Orchestration - Executes containerized tasks via external orchestration drivers to manage application placement across a cluster.
• Local Image Caching - Implements a local image store using overlay filesystems to fetch, store, and render container images.
• Orchestration Integration - Connects the runtime with init systems and cluster orchestrators via a composable design.
• Systemd Lifecycle Management - Integrates the lifecycle of containerized applications with systemd unit files for automated restarts and dependency sequencing.
• Hardware-Backed Manifest Verification - Records image hashes into a trusted platform module to create a cryptographically verifiable audit trail.
• Pluggable Runtimes - Employs a composable design that allows swapping different execution engines for immutable or mutable execution.
• Container Image Signatures - Checks cryptographic signatures of image manifests against a trusted keystore to ensure authenticity.
• Linux Capability Management - Limits the Linux kernel capabilities granted to applications within a pod to reduce the attack surface.
• Container Monitoring - Tracks CPU, memory, and performance metrics for active containers to ensure system health.
• Container Resource Constraints - Constrains the hardware resources available to a pod using CPU, memory, and IO limits.
• Hardware-Backed Integrity Logs - Records filesystem and manifest hashes into a TPM to create a cryptographically verifiable audit trail.

Star history