Awesome GitHub RepositoriesRootless Execution

Moby is an OCI container engine and runtime manager designed for building, running, and managing isolated containers based on Open Container Initiative standards. It functions as a container daemon and image builder, providing a core engine to orchestrate the full lifecycle of containers and the packaging of source code into portable images. The project provides a standardized HTTP interface that allows for programmatic container management, enabling external clients to control daemon settings and container operations. It supports a rootless security model, allowing the engine daemon to execu

Buildkit is a programmable container build toolkit and OCI container image builder that converts build definitions into concurrent dependency graphs for image construction. It functions as an OCI image distribution engine, capable of generating container images and exporting artifacts to local storage or remote registries. The project is distinguished by its use of a low-level binary intermediate representation to decouple high-level build languages from the execution engine. It supports multi-platform image builds through user-mode architecture emulation and provides a distributed build cach

Buildah is a tool for creating OCI-compliant container images without requiring a background daemon process. It functions as a daemonless image constructor and distribution tool, allowing users to build, push, and pull images between local storage and remote registries. The project distinguishes itself by supporting unprivileged image building through the use of user namespaces and rootless mode. It enables direct modification of container root filesystems by mounting them to the host, allowing images to be treated as directories that can be manipulated via standard shell commands or scripts.

Finch 是一个基于虚拟机的容器运行时和 OCI 容器管理 CLI，用于本地容器开发。它通过在后台虚拟机中运行容器工作负载，将其与宿主操作系统隔离。该项目作为 OCI 镜像构建器和多容器服务编排器，用于在工作站上模拟复杂的生产环境。 该运行时作为跨平台容器引擎，利用仿真层执行为外来 CPU 架构构建的容器镜像。它通过延迟加载支持和可搜索索引的生成来区分其镜像分发方式，允许容器在完整镜像拉取完成前启动。 该项目涵盖了广泛的能力，包括 OCI 镜像生命周期管理、虚拟机资源配置和多容器应用编排。它提供了网络管理、卷持久化以及镜像签名和验证工具。 该系统包含一个支持 Shell 自动补全并兼容传统容器命令的命令行界面。