Awesome GitHub RepositoriesOCI Runtime Implementations

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

Meshery is a service mesh management plane and cloud native infrastructure orchestrator. It provides a visual design-as-code environment for modeling microservices and infrastructure components through declarative blueprints, functioning as a centralized platform for designing, deploying, and managing service mesh infrastructure. The platform is distinguished by its ability to translate visual designs into active deployments and its use of gRPC-based adapters to integrate with diverse infrastructure providers. It features a multi-tenant architecture that manages shared workspaces and role-bas

rkt 是一个安全的 Linux 容器引擎和 Pod 原生容器管理器。它提供了一个可组合的执行环境，用于在 Linux 上启动和管理隔离的应用程序容器，作为一个围绕镜像格式和网络接口的开放行业标准设计的运行时。 该系统以 Pod 原生执行模型为特色，将多个容器和共享资源分组为单个、自包含的单元。它利用可插拔的执行引擎提供安全隔离，包括使用基于硬件的虚拟化在主机系统和运行中的应用程序之间创建安全边界。 该项目涵盖了容器管理的广泛功能，包括符合 OCI 标准的镜像执行和基于 CNI 的网络。它还提供与集群编排器和系统初始化工具的集成，以管理跨分布式环境的工作负载。

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

Youki 是一个用 Rust 编写的 OCI 容器运行时。它实现了 Open Container Initiative (OCI) 运行时规范，以管理容器化进程的生命周期，并确保与标准容器镜像和引擎的兼容性。 该运行时专为内存安全而设计，并支持无根 (rootless) 容器执行，允许容器以非 root 用户身份运行，从而降低安全风险并限制权限提升。 它提供了核心容器管理能力，包括生成和管理 OCI 容器。这是通过 Linux 命名空间隔离、基于 cgroup 的资源限制以及用户命名空间映射来实现的，从而将进程与宿主操作系统隔离开来。

Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-

x11docker 是一个 OCI 容器 GUI 编排器和硬件桥接工具，旨在容器内运行图形化应用程序和完整的桌面环境。它作为一个 Linux GUI 沙箱，将容器化进程连接到宿主机的 X11 或 Wayland 显示服务器及音频系统。 该项目通过提供深度系统集成（包括 NVIDIA 驱动自动化和 GPU 直通）来实现硬件加速，从而脱颖而出。它支持跨架构 GUI 模拟，并通过 VNC、SSH 转发和基于浏览器的 HTML5 渲染提供远程访问能力。 该工具涵盖了广泛的集成功能，包括用于安全的命名空间身份映射、用于进程间通信的 D-Bus 会话桥接，以及双向剪贴板同步。它还处理摄像头和打印机等外设共享，以及 init 系统和持久化存储挂载的管理。 该软件是一个基于 shell 的实用程序，支持包括 Docker 和 Podman 在内的多种符合 OCI 标准的后端。

CRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th

Pouch is a Linux container runtime and OCI container engine designed to execute containerized applications. It functions as a Kubernetes container runtime, integrating with orchestrators to manage the lifecycle of pods and isolated application environments. The project features a peer-to-peer image distribution system to deliver large container images across large-scale clusters while reducing bandwidth load. It also provides support for legacy Linux kernel versions, allowing modern container runtimes to maintain compatibility with older hardware. The runtime implements application isolation

crun 是一个低级容器运行时，实现了用于管理隔离进程生命周期的 Open Container Initiative 规范。它提供容器创建、执行和删除的核心机制，通过标准化的生命周期管理确保跨平台兼容性。 该项目通过提供一个共享 C 库脱颖而出，允许将容器运行时操作直接嵌入到其他编译后的应用程序中。它通过专门的处理程序进一步扩展了执行能力，支持在隔离的微型虚拟机（microVM）中部署容器或执行 WebAssembly 工作负载。 该运行时涵盖广泛的底层隔离和资源管理功能。这包括使用命名空间和 seccomp 过滤器进行安全防护，使用 cgroups 强制执行 CPU 和内存限制，以及通过检查点和恢复功能保存与恢复容器执行状态的工具。它还提供用于动态资源更新、挂载管理以及通过嵌入式 Lua 接口进行自动化的接口。

Unikraft is a modular library operating system and unikernel framework designed to compile applications into minimal, bootable virtual machine images. It serves as an OCI-compliant image builder and a cloud-native hypervisor target, enabling the creation of specialized runtimes that include only the specific drivers and libraries required by a single application. The system features a Linux compatibility layer that maps standard API calls and POSIX standards to unikernel libraries, allowing unmodified binaries to run without a full general-purpose kernel. It distinguishes itself by allowing c