Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster.
The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-root users to reduce security risks and remove the need for administrative privileges.
The runtime covers a broad range of system capabilities, including Linux sandbox provisioning, hardware resource limit configuration via cgroups, and security hardening through system call filtering. It also handles container network interface management, process execution control, and the full container lifecycle from creation to termination.
The project includes tooling for multi-architecture cross-compilation and automated provisioning of virtualized Linux environments for testing and development.