rootless container sandbox that starts in 3.5 ms.

A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. One 1.52 MB static binary, no daemon, 0 RAM at rest.

One binary that manages resources, of which isolation is the first. That is why there is no single row for kern in a comparison table: it is a container runtime, a sandbox, a resource slicer and a stack runner at once, in 1.52 MB with no daemon.

• kern @ GitHub.

youki is an implementation of the OCI runtime-spec in Rust, similar to runc.

• Youki @ GitHub.

Sysbox is an open-source, next-generation runc that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.

Related contents:

• Your Container Is Not a Sandbox @ Emir Beganović.

A fast and lightweight fully featured OCI runtime and C library for running containers

The Container Security Platform. Application Kernel for Containers.

gVisor provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a Linux-like interface. Unlike Linux, it is written in a memory-safe language (Go) and runs in userspace.

gVisor includes an Open Container Initiative (OCI) runtime called runsc that makes it easy to work with existing container tooling. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.

• gVisor @ GitHub.

CLI tool for spawning and running containers according to the OCI specification.