Awesome GitHub RepositoriesUserspace Kernels

This project is a secure container runtime that provides strong isolation for application workloads by implementing a userspace kernel. By intercepting system calls and executing them within a memory-safe, restricted environment, it minimizes the attack surface exposed to the host kernel. It functions as a drop-in engine for standard container orchestration platforms, ensuring compatibility with industry-standard runtime specifications while maintaining a hardened execution boundary. The runtime distinguishes itself through its ability to virtualize core system resources, including an indepen

Redox is a POSIX-compliant, microkernel-based operating system written entirely in Rust. By utilizing a memory-safe language for the kernel and all system components, the project eliminates common vulnerabilities such as buffer overflows and use-after-free errors. Its architecture relies on a minimal kernel that manages only essential hardware and process isolation, delegating all other system services to unprivileged user-space processes. The system distinguishes itself through a modular design where hardware drivers and system services run as independent user-space daemons, allowing them to

OpenCorePkg is a modular UEFI bootloader designed to initialize hardware and facilitate the loading of modern operating systems on non-standard or unsupported hardware. It functions as a comprehensive firmware emulation environment, providing the necessary runtime services and memory management to bridge the gap between diverse hardware configurations and operating system requirements. The project distinguishes itself through its ability to perform runtime kernel patching and system firmware modification, allowing for the injection of drivers and the manipulation of hardware tables during the

NodeOS is an operating system that boots a Linux kernel with Node.js running as the primary userspace, replacing traditional shell utilities with JavaScript execution. Every npm package is treated as a native system command, making hundreds of thousands of packages directly executable at the OS level. The operating system is built inside Docker containers using a reproducible pipeline that generates ext2 filesystem images, with the ability to conditionally disable KVM for systems without hardware virtualization. It mounts a persistent usersfs partition for user home directories, preserving ch

Afero is a Go library that provides a unified filesystem abstraction, allowing applications to interact with local disk, in-memory storage, cloud services, archives, and remote systems through a single, consistent interface. At its core, it defines a standard interface that all filesystem backends implement, enabling developers to swap storage implementations without changing application code. The library distinguishes itself through its composable architecture, which includes layered filesystem composition for creating cached, sandboxed, or restricted storage views. It offers a copy-on-write

libfuse is a library and kernel module combination that enables the development of custom Linux filesystems that run in userspace rather than in kernel space. It provides a bridge between the kernel's virtual filesystem layer and a userspace daemon, allowing filesystem operations to be forwarded and handled by a regular user process. The project offers two distinct APIs: a high-level callback-driven API where filesystem operations are implemented as simple functions that return results synchronously, and a low-level API that exposes raw kernel request structures directly for fine-grained contr

seL4 is a formally verified microkernel whose C implementation is backed by machine-checked mathematical proofs of correctness, confidentiality, integrity, and availability. It enforces strict isolation between processes through hardware-enforced address space separation and a capability-based access control system, where each process holds explicit rights only to the resources it has been granted. The kernel exposes hardware resources through a minimal API of system calls that manage threads, address spaces, and inter-process communication, with synchronous IPC supporting sender-identifying b

该项目是一个教育资源，提供了一个全面的开发教程，用于在 Linux 内核中使用 C、Go 和 Rust 编写并加载 eBPF 程序。它作为一个技术指南，用于开发直接在内核中执行的自定义逻辑。 这些材料涵盖了专门的领域，包括内核可观测性和追踪、用于入侵检测的安全实现，以及用于包过滤和负载均衡的高性能网络工程。它还包括用于 Linux 内核追踪以及使用 kprobes、uprobes 和 tracepoints 的专用手册。 该项目涵盖了广泛的功能领域，如内核插桩、系统监控和可观测性、网络分析以及安全强制执行。它进一步扩展到 GPU 和驱动程序的硬件级调试，以及底层系统操作和资源管理。