Youki

Youki 是一个用 Rust 编写的 OCI 容器运行时。它实现了 Open Container Initiative (OCI) 运行时规范，以管理容器化进程的生命周期，并确保与标准容器镜像和引擎的兼容性。

该运行时专为内存安全而设计，并支持无根 (rootless) 容器执行，允许容器以非 root 用户身份运行，从而降低安全风险并限制权限提升。

它提供了核心容器管理能力，包括生成和管理 OCI 容器。这是通过 Linux 命名空间隔离、基于 cgroup 的资源限制以及用户命名空间映射来实现的，从而将进程与宿主操作系统隔离开来。

Features

OCI Container Process Management - Implements the OCI runtime specification to manage the complete lifecycle of containerized processes.
Container Runtimes - Serves as an OCI-compliant container runtime for executing isolated application workloads.
OCI Runtime Implementations - Adheres to the Open Container Initiative specifications to ensure compatibility across container engines.
Namespace-Based Isolation - Utilizes Linux kernel namespaces to isolate network, mount, and process views from the host.
System Call Interfaces - Directly invokes Linux kernel system calls to handle process spawning and root filesystem pivoting.
Rootless Container Runtimes - Provides a runtime environment that allows containers to run without requiring root privileges on the host.
User Namespace Mappings - Maps container root users to non-privileged host users to enable rootless container execution.
Memory Safety - Leverages Rust's ownership model to ensure memory safety during low-level kernel interactions.
Rust Systems Programming - Uses Rust for systems programming to provide a high-performance, memory-safe container runtime.
Container Runtimes - Implements a systems-level container runtime using Rust for enhanced memory safety and performance.
Container Cgroup Resource Limits - Implements cgroup-based resource limits to restrict CPU, memory, and I/O consumption for containers.
Container Engines - Container runtime implementation written in Rust.
runc - Listed in the “runc” section of the Awesome Alternatives In Rust awesome list.

Star 历史

containersyouki

Name: containers/youki
Author: containers

View on GitHub

7,463 星标442 分支RustApache-2.09 次浏览youki-dev.github.io/youki

Youki

该运行时专为内存安全而设计，并支持无根 (rootless) 容器执行，允许容器以非 root 用户身份运行，从而降低安全风险并限制权限提升。

Features

OCI Container Process Management - Implements the OCI runtime specification to manage the complete lifecycle of containerized processes.
Container Runtimes - Serves as an OCI-compliant container runtime for executing isolated application workloads.
OCI Runtime Implementations - Adheres to the Open Container Initiative specifications to ensure compatibility across container engines.
Namespace-Based Isolation - Utilizes Linux kernel namespaces to isolate network, mount, and process views from the host.
System Call Interfaces - Directly invokes Linux kernel system calls to handle process spawning and root filesystem pivoting.
Rootless Container Runtimes - Provides a runtime environment that allows containers to run without requiring root privileges on the host.
User Namespace Mappings - Maps container root users to non-privileged host users to enable rootless container execution.
Memory Safety - Leverages Rust's ownership model to ensure memory safety during low-level kernel interactions.
Rust Systems Programming - Uses Rust for systems programming to provide a high-performance, memory-safe container runtime.
Container Runtimes - Implements a systems-level container runtime using Rust for enhanced memory safety and performance.
Container Cgroup Resource Limits - Implements cgroup-based resource limits to restrict CPU, memory, and I/O consumption for containers.
Container Engines - Container runtime implementation written in Rust.
runc - Listed in the “runc” section of the Awesome Alternatives In Rust awesome list.

Youki 的开源替代方案

相似的开源项目，按与 Youki 的功能重合度排序。

containers/crun
containers/crun
3,975在 GitHub 上查看
crun is a low-level container runtime that implements the Open Container Initiative specification for managing the lifecycle of isolated processes. It provides the core mechanisms for container creation, execution, and deletion, ensuring compatibility across platforms through standardized lifecycle management. The project distinguishes itself by offering a shared C library that allows container runtime operations to be embedded directly into other compiled applications. It further extends execution capabilities through specialized handlers that enable the deployment of containers within isola
Ccontainersiotiot-cloud
在 GitHub 上查看3,975
youki-dev/youki
youki-dev/youki
7,452在 GitHub 上查看
Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-
Rustcontainersdockerkubernetes
在 GitHub 上查看7,452
lxc/incus
lxc/incus
4,893在 GitHub 上查看
Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin
Gocloudcontainershacktoberfest
在 GitHub 上查看4,893
opencontainers/runc
opencontainers/runc
13,067在 GitHub 上查看
runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container Initiative specification. It serves as a low-level container execution engine that interfaces directly with the host operating system to manage the lifecycle of isolated processes. The tool functions as a Linux process containerizer, utilizing kernel features such as namespaces for process isolation and control groups for resource governance. It enforces security by restricting processes to specific directory trees and dropping unnecessary kernel privileges to minimize the attac
Gocontainersdockeroci
在 GitHub 上查看13,067

查看 Youki 的所有 30 个替代方案

常见问题解答

containers/youki 是做什么的？

containers/youki 的主要功能有哪些？

containers/youki 的主要功能包括：OCI Container Process Management, Container Runtimes, OCI Runtime Implementations, Namespace-Based Isolation, System Call Interfaces, Rootless Container Runtimes, User Namespace Mappings, Memory Safety。

containers/youki 有哪些开源替代品？

containers/youki 的开源替代品包括： containers/crun — crun is a low-level container runtime that implements the Open Container Initiative specification for managing the… youki-dev/youki — Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open… lxc/incus — Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual… opencontainers/runc — runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container… lxc/lxc — LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on… aliyuncontainerservice/pouch — Pouch is a Linux container runtime and OCI container engine designed to execute containerized applications. It…