nestybox/sysbox 的主要功能有哪些？

nestybox/sysbox 的主要功能包括：VM-Like Isolation Runtimes, Container, ID-Shifting, Repository-Built Container Hook Runs, System Software Container Runs, System Software Container Execution, Docker-in-Docker Runtimes, Inner Container Deployments。

nestybox/sysbox 有哪些开源替代品？

nestybox/sysbox 的开源替代品包括： opencontainers/runtime-spec — The project provides an open container runtime specification and standardized schema for defining container… lxc/lxc — LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on… opencontainers/runc — runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container… lxc/incus — Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual… containers/bubblewrap — Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted… actions/actions-runner-controller — Kubernetes controller for GitHub Actions self-hosted runners.

Sysbox

Sysbox is an OCI-compliant container runtime that provides virtual-machine-level isolation for containers without requiring hardware virtualization. It achieves this by mapping the container's root user to an unprivileged host user ID range, virtualizing the /proc and /sys filesystems, and applying seccomp-BPF system call filtering, all while using cgroup v2 for resource partitioning.

The runtime enables running system-level software such as systemd, Docker, and Kubernetes inside unprivileged containers without requiring special images or privileged mode. It supports nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker workflows, and uses shiftfs overlay filesystem for shared filesystem access between host and container namespaces. Sysbox also integrates OCI runtime hooks to configure namespaces, cgroups, and mounts at container lifecycle events.

The project provides capabilities for partitioning bare-metal or cloud instances into multiple isolated compute environments with higher density than virtual machines, and for replacing virtual machines with faster, more portable containers for running legacy applications and multi-service workloads. Documentation and installation instructions are available through the project's repository.

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Star 历史

nestyboxsysbox

Name: nestybox/sysbox
Author: nestybox

View on GitHub

3,458 星标201 分支Shellapache-2.014 次浏览

Sysbox

Features

VM-Like Isolation Runtimes - An OCI-compliant container runtime providing virtual-machine-level isolation without hardware virtualization.
Container - Enables Docker-in-Docker and Kubernetes-in-Docker by stacking PID, mount, and network namespaces.
ID-Shifting - Translates user and group IDs on disk between host and container namespaces for shared filesystem access.
Repository-Built Container Hook Runs - Runs system-level workloads such as systemd, Docker, and Kubernetes inside containers without special images.
System Software Container Runs - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
System Software Container Execution - Runs system-level software like systemd, Docker, and Kubernetes inside containers without privileged mode.
Docker-in-Docker Runtimes - An OCI runtime that securely deploys inner Docker and Kubernetes containers without privileged mode or host socket mounts.
Inner Container Deployments - Ships nested namespace stacking for Docker-in-Docker and Kubernetes-in-Docker without privileged mode.
Systemd-in-Container Runtimes - Enables running systemd, Docker, and Kubernetes inside unprivileged containers without special images.
Container-Specific Procfs and Sysfs Views - Presents container-specific views of /proc and /sys, hiding host kernel details and hardening isolation.
VM-Like Container Isolations - Provides VM-level isolation by mapping container root to unprivileged users and virtualizing procfs and sysfs.
Root User Mapping and Filesystem Virtualization - Maps container root to unprivileged host users and virtualizes procfs and sysfs to harden isolation.
Seccomp Profiles - Applies a custom seccomp profile to block dangerous system calls while allowing legitimate ones.
Container Runtime Hooks - Injects custom logic at container lifecycle events to configure namespaces, cgroups, and mounts.
Filesystem Root Restrictions - Restricts container filesystem access to a dedicated root directory, preventing escape to host paths.
User ID Mapping Configurations - Maps container root to an unprivileged host user ID range, preventing privilege escalation outside the container.
Cgroup V2 Hierarchical Allocations - Provides fine-grained resource partitioning via the unified cgroup v2 hierarchy for container isolation.
VM Replacement Containers - Replaces virtual machines with faster, more portable containers for running legacy apps and multi-service workloads.
High-Density Compute Partitioning Tools - Partitions bare-metal or cloud instances into multiple isolated environments with higher density than VMs.
Host-Level Compute Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Host-Level Environment Partitioning - Divides bare-metal or cloud instances into multiple isolated compute environments with higher density than VMs.
Container Engines - Creates secure, rootless containers capable of running systemd and Docker.

Sysbox 的开源替代方案

相似的开源项目，按与 Sysbox 的功能重合度排序。

opencontainers/runtime-spec
opencontainers/runtime-spec
3,641在 GitHub 上查看
The project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and
Gocontainersdockeroci
在 GitHub 上查看3,641
lxc/lxc
lxc/lxc
5,204在 GitHub 上查看
LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile
C
在 GitHub 上查看5,204
opencontainers/runc
opencontainers/runc
13,067在 GitHub 上查看
runc is a command-line utility for spawning and running containers on Linux systems according to the Open Container Initiative specification. It serves as a low-level container execution engine that interfaces directly with the host operating system to manage the lifecycle of isolated processes. The tool functions as a Linux process containerizer, utilizing kernel features such as namespaces for process isolation and control groups for resource governance. It enforces security by restricting processes to specific directory trees and dropping unnecessary kernel privileges to minimize the attac
Gocontainersdockeroci
在 GitHub 上查看13,067
containers/bubblewrap
containers/bubblewrap
5,839在 GitHub 上查看
Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc
Clinux-containersuser-namespaces
在 GitHub 上查看5,839

查看 Sysbox 的所有 30 个替代方案

常见问题解答

nestybox/sysbox 是做什么的？