container
IncusOS is an immutable OS solely designed around safely and reliably running Incus. It uses modern security features like UEFI Secure Boot and TPM to provide a safe boot experience and seamless full disk encryption.
Related contents:
The Developer Friendly Container & Microservices Platform
Built to maximize developer happiness. Works on any cloud, easy to setup, simple to use.
Lock, Stock, and Two Smoking MicroVMs. Create and manage the lifecycle of MicroVMs backed by containerd.
A streamlined service to manage the lifecycle of microVMs. Flintlock lets you focus on deploying your application in MicroVMs tailored for its need.
The original use case for flintlock was to create microVMs on a bare-metal host where the microVMs will be used as nodes in a virtualized Kubernetes cluster. It is an essential part of Liquid Metal and can be orchestrated by Cluster API Provider Microvm.
A tiny but valid init for containers. Tini is the simplest init you could think of.
All Tini does is spawn a single child (Tini is meant to be run in a container), and wait for it to exit all the while reaping zombies and performing signal forwarding.
Optimize your app creation.
Lenra is an open source framework to create your app using any language, and deploy it without any Ops scale, built on ethical values.
Powerful system container and virtual machine manager.
Incus is a next generation system container and virtual machine manager. It offers a unified user experience around full Linux systems running inside containers or virtual machines.
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
Related contents:
A collaborative project for the container ecosystem to assemble container-based systems. Moby is an open-source project created by Docker to enable and accelerate software containerization.
It provides a "Lego set" of toolkit components, the framework for assembling them into custom container-based systems, and a place for all container enthusiasts and professionals to experiment and exchange ideas. Components include container build tools, a container registry, orchestration tools, a runtime and more, and these can be used as building blocks in conjunction with other tools and projects.
A CLI/TUI that simplifies launching VSCode projects, with a focus on dev containers.
kube-image-keeper (a.k.a. kuik) is a container image caching system designed for Kubernetes. It ensures the availability of your favorite container images by keeping a local copy within your k8s cluster.
Secure and fast microVMs for serverless computing. Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services that provide serverless operational models. Firecracker runs workloads in lightweight virtual machines, called microVMs, which combine the security and isolation properties provided by hardware virtualization technology with the speed and flexibility of containers.
VaultOS is a terminal-based user interface (TUI) for managing "Desktop" Docker containers.
VaultOS is a terminal-based user interface (TUI) for managing "Desktop" Docker containers. It allows you to effortlessly spin up ephemeral or persistent Linux desktop environments (like Alpine XFCE, Ubuntu KDE, etc.) accessible directly via your web browser.
Fully managed DevOps platform to deploy your code and open-source software
No more DevOps. Deploy on any cloud or on-premise. Scalable & Secure. CI/CD Pipelines.
Our mission is to be the trusted cloud native repository for Kubernetes. Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted. Harbor, a CNCF Graduated project, delivers compliance, performance, and interoperability to help you consistently and securely manage artifacts across cloud native compute platforms like Kubernetes and Docker.
Related contents:
A Firecracker micro VM management tool. Run Docker images as micro VMs.
The Container Streaming Platform. Stream your workspace directly to your web browser on any device and from any location.
Related contents:
Boot and upgrade via container images.
Transactional, in-place operating system updates using OCI/Docker container images. bootc is the key component in a broader mission of bootable containers.
The original Docker container model of using "layers" to model applications has been extremely successful. This project aims to apply the same technique for bootable host systems - using standard OCI/Docker containers as a transport and delivery format for base operating system updates.
professional hacking setup.
Exegol is a community-driven hacking environment, powerful and yet simple enough to be used by anyone in day to day engagements. Exegol is the best solution to deploy powerful hacking environments securely, easily, professionally. No more unstable, not-so-security-focused systems lacking major offensive tools. Kali Linux (and similar alternatives) are great toolboxes for learners, students and junior pentesters. But professionals have different needs, and their context require a whole new design.
Related contents:
Windows pod system for Linux.
Native Linux windows for every Windows app — real icons, real WM_CLASS, pin-to-taskbar. FreeRDP RemoteApp + dockur/windows. Zero config.
Docker Registry UI.
A simple, lightweight UI for exploring and managing Docker/OCI container registries.
Expose your services easily and securely.
This project comes as a pre-built docker image that enables you to easily forward to your websites running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.
Related contents:
- NPM Mobile Manager @ GitHub.
- HomeLab SSL certificates for FREE with minimal effort @ Perkelator's YouTube.
- Self-Hosted SSL Simplified: Nginx Proxy Manager @ Lawrence Systems' YouTube.
- The First Services I Always Spin Up in Any Home Lab @ VirtualizationHowto.
- Nginx Proxy Manager - Le reverse proxy que même ma grand-mère pourrait configurer @ Korben :fr:.
Purpose-built OS for Kubernetes, fully managed by Kubernetes. k3OS is a Linux distribution designed to remove as much OS maintenance as possible in a Kubernetes cluster. It is specifically designed to only have what is needed to run k3s. Additionally the OS is designed to be managed by kubectl once a cluster is bootstrapped. Nodes only need to join a cluster and then all aspects of the OS can be managed from Kubernetes. Both k3OS and k3s upgrades are handled by the k3OS operator.
Docker Image Update Notifier is a CLI application written in Go and delivered as a single executable (and a Docker image) to receive notifications when a Docker image is updated on a Docker registry.
A Lightweight, Ready-to-Use Web Browsing Environment in Docker with VNC Access.
VNC-Browser is a ready to use, minimal, customizable docker image designed to provide a lightweight and secure environment for browsing the web via VNC.
A tool for exploring each layer in a docker image. A tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image.
Kubernetes distribution for bare-metal, on-prem, edge, IoT.
k0s is the simple, solid & certified Kubernetes distribution that works on any infrastructure: bare-metal, on-premises, edge, IoT, public & private clouds. It's 100% open source & free.
Related contents:
Agentless Vulnerability Scanner for Linux/FreeBSD.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices.
A terminal for a container-oriented desktop.
Ptyxis is a terminal for GNOME with first-class support for containers. Flatpak is the intended and preferred distribution mechanism.
Internal Tools Deployment Platform. Webapp Management for Internal Tools.
Platform for securely developing and deploying web tools across a team. Application server for containerized webapps. Create and share webapps for CLI applications.
Clace combines the functionality of a reverse proxy, a hypermedia based micro-framework and a container orchestrator (using Docker or Podman) in a single lightweight binary. After starting the Clace server and ensuring Docker or Podman is running, new apps can be installed in one command from GitHub source repo. Clace builds the image and starts the container lazily, on the first API call. Clace can also automatically build simple form based UI for backend APIs.
Backup multiple database types on a scheduled basis with many customizable options. This will build a container for backing up multiple types of DB Servers.
Backs up CouchDB, InfluxDB, MySQL/MariaDB, Microsoft SQL, MongoDB, Postgres, Redis servers.
A CLI to create code sandboxes with automatic HTTPS and long running processes in your cloud provider account.
RamaLama strives to make working with AI simple, straightforward, and familiar by using OCI containers.
RamaLama is an open-source developer tool that simplifies the local serving of AI models from any source and facilitates their use for inference in production, all through the familiar language of containers.
Related contents:
Turnkey Kubernetes networking solution.
The Kube-router is a turnkey solution for Kubernetes networking with aim to provide operational simplicity. Networking is hard as such. In typical Kubernetes cluster you would need to install multiple network components for various functionality. With many moving parts it makes Kubernetes networking even harder. Kube-router provides a cohesive yet lean and powerful alternative to several network components you would use. All this from a single DaemonSet/Binary. It doesn't get any easier.
An operating system designed for hosting containers. Bottlerocket is an operating system for the worker nodes in an orchestrated container cluster.
Bottlerocket is a Linux-based operating system optimized for hosting containers. It’s free and open-source software, developed in the open on GitHub. Bottlerocket is installed as the base operating system on the machine or instance where your containers themselves are running. It is specifically designed to work with your container orchestrator (like Kubernetes) to automate the lifecycle of the containers running in your cluster. Bottlerocket runs in the cloud or in your datacenter.
Transactional, in-place operating system updates using OCI/Docker container images. bootc is the key component in a broader mission of bootable containers.
Related contents:
Proxy for connecting to Podman rootless containers by domain name.
Makes Firefox the World's First Cloud-Native Dev Browser!
Seriously though, Podfox is a SOCKS5 proxy for accessing Podman's rootless network namespace from the host. Podfox creates a convenient virtual domain hierarchy in the proxy: a <container>.<network>.podman request gets resolved as <container>.dns.podman on <network>'s aardvark-dns server. Firefox can be configured to use it through a PAC policy or an included one-liner extension (TODO: maybe publish to AMO?).
Related contents:
Run Windows applications (including Microsoft 365 and Adobe Creative Cloud) on GNU/Linux with KDE, GNOME or XFCE, integrated seamlessly as if they were native to the OS.
Related contents:
Chrome Headless docker images built upon alpine official image.
In the world of webdev, the ability to run quickly end-to-end tests are important. Popular technologies like Puppeteer enable developers to make fun things like testing, automating forms, crawling, generating screenshots, capturing timeline... And there is a secret: some of these features are directly available on Chrome! 🙌
A Bloat Aware Filesystem for Container Debloating.
BLAFS is a bloat-aware filesystem for container debloating. The design principles of BLAFS are effective, efficient, and easy to use. It detects the files used by the container, and then debloats the container by removing the unused files. The debloated containers are still functional and can run the same workload as the original containers, but with a much smaller size and faster deployment.
an open source geocoder for openstreetmap data.
photon is an open source geocoder built for OpenStreetMap data. It is based on elasticsearch/OpenSearch - an efficient, powerful and highly scalable search platform.
Related contents:
Kubernetes Dashboard is a general purpose, web-based UI for Kubernetes clusters. It allows users to manage applications running in the cluster and troubleshoot them, as well as manage the cluster itself.
Code signing and transparency for containers and binaries. Signing OCI containers (and other artifacts) using Sigstore! Cosign aims to make signatures invisible infrastructure.
Related contents:
SaaS-simple deployment of Kubernetes - on your own hardware.
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Built on Talos Linux by the folks at Sidero.
An open specification for enriching containers with development specific content and settings.
A Development Container (or Dev Container for short) allows you to use a container as a full-featured development environment. It can be used to run an application, to separate tools, libraries, or runtimes needed for working with a codebase, and to aid in continuous integration and testing. Dev containers can be run locally or remotely, in a private or public cloud.
Related contents:
ContainerCleaner is a tool for automatically updating compose file containers/images and removing unused images.
Preevy is a powerful CLI tool designed to simplify the process of creating ephemeral preview environments. Using Preevy, you can easily provision any Docker-Compose application on AWS using affordable Lightsail, Google Cloud, or Microsoft Azure VMs (support for more cloud providers is on the way).
An OCI base image of Fedora CoreOS with batteries included.
uCore is an OCI image of Fedora CoreOS with "batteries included". More specifically, it's an opinionated, custom CoreOS image, built daily with some common tools added in. The idea is to make a lightweight server image including commonly used services or the building blocks to host them.
Simplify observability, traffic management, security, and policy with the leading service mesh.
Istio extends Kubernetes to establish a programmable, application-aware network using the powerful Envoy service proxy. Working with both Kubernetes and traditional workloads, Istio brings standard, universal traffic management, telemetry, and security to complex deployments.
- Istio @ GitHub.
- Istio de A à Y @ Une tasse de café :fr:.
- The Istio Service Mesh for People Who Have Stuff to Do @ lucavallin.
- Service Meshes Decoded Part One: A performance comparison of Istio vs Linkerd vs Cilium @ LiveWyer.
- Airbnb Executes Istio Upgrades at Massive Scale @ InfoQ.
- An In-Depth Look at Istio Ambient Mode with Calico @ Tigera.
- Using Istio to manage high-traffic services @ CNCF.
- The agent pull request flood is here. If you run Istio, you’re halfway to solving it @ The New Stack.
- How we replaced Ingress-NGINX at Stack Overflow @ Stack Overflow blog.
Fast, light, simple Docker & Linux on macOS.
OrbStack is the fast, light, and easy way to run Docker containers and Linux. Develop at lightspeed with our Docker Desktop alternative.
Related contents:
The Registry is a stateless, highly scalable server side application that stores and lets you distribute container images and other content.
This repository's main product is the Open Source Registry implementation for storing and distributing container images and other content using the OCI Distribution Specification. The goal of this project is to provide a simple, secure, and scalable base for building a large scale registry solution or running a simple private registry. It is a core library for many registry operators including Docker Hub, GitHub Container Registry, GitLab Container Registry and DigitalOcean Container Registry, as well as the CNCF Harbor Project, and VMware Harbor Registry.
Related contents:
With JupyterHub you can create a multi-user Hub that spawns, manages, and proxies multiple instances of the single-user Jupyter notebook server. Project Jupyter created JupyterHub to support many users. The Hub can offer notebook servers to a class of students, a corporate data science workgroup, a scientific research project, or a high-performance computing group. JupyterHub brings the power of notebooks to groups of users. It gives users access to computational environments and resources without burdening the users with installation and maintenance tasks. Users - including students, researchers, and data scientists - can get their work done in their own workspaces on shared resources which can be managed efficiently by system administrators. JupyterHub @ GitHub
Reloader can watch changes in ConfigMap and Secret and do rolling upgrades on Pods with their associated DeploymentConfigs, Deployments, Daemonsets Statefulsets and Rollouts.
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig.
The Open Container Initiative is an open governance structure for the express purpose of creating open industry standards around container formats and runtimes.
Established in June 2015 by Docker and other leaders in the container industry, the OCI currently contains three specifications: the Runtime Specification (runtime-spec), the Image Specification (image-spec) and the Distribution Specification (distribution-spec). The Runtime Specification outlines how to run a “filesystem bundle” that is unpacked on disk. At a high-level an OCI implementation would download an OCI Image then unpack that image into an OCI Runtime filesystem bundle. At this point the OCI Runtime Bundle would be run by an OCI Runtime.
Related contents:
Self-hosted - Docker compose.yaml - Stack-oriented Manager.
Related contents:
Control panel to Start/Stop/View Logs for apps in Docker, Systemd, VMs or anything else (with user scripts).
Update monitor & manager for applications using the Omaha protocol, optimized for Flatcar Container Linux. Nebraska is an update manager for Flatcar Container Linux. Nebraska offers an easy way to monitor and manage the rollout of updates to applications that use the Omaha protocol, with special functionality for Flatcar Container Linux updates.
container is a tool that you can use to create and run Linux containers as lightweight virtual machines on your Mac. It's written in Swift, and optimized for Apple silicon.
The tool consumes and produces OCI-compliant container images, so you can pull and run images from any standard container registry. You can push images that you build to those registries as well, and run the images in any other OCI-compliant application.
Related contents:
Patch the past. Build the future. Eliminate your CVEs
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.:
1,700+ trusted container images to eliminate your vulnerabilities and mitigate malware.
Related contents:
layerleak the Docker Hub Secret Scanner.
Traditional secret scanners often treat a container image as a flat blob or depend on a local Docker daemon. This project is designed around OCI image internals