Search Results for "c memory allocator"

A fast and low-memory footprint OCI Container Runtime fully written in C. While most of the tools used in the Linux containers ecosystem are written in Go, I believe C is a better fit for a lower-level tool like container runtime. runc, the most used implementation of the OCI runtime specs written in Go, re-execs itself and uses a module written in C for setting up the environment before the container process starts. crun aims to be also usable as a library that can be easily included in programs without requiring an external process for managing OCI containers.

...However, the container runtime requires the use of system calls, which requires a bit of special handling when implemented in Go. This is too tricky (e.g. namespaces(7), fork(2)); with Rust, it's not that tricky. And, unlike in C, Rust provides the benefit of memory safety. While Rust is not yet a major player in the container field, it has the potential to contribute a lot: something this project attempts to exemplify. youki has the potential to be faster and use less memory than runc, and therefore works in environments with tight memory usage requirements. ...

ChaosBlade is an Alibaba open source experimental injection tool that follows the principles of chaos engineering and chaos experimental models to help enterprises improve the fault tolerance of distributed systems and ensure business continuity during the process of enterprises going to cloud or moving to cloud-native systems. Chaosblade is an internal open-source project of MonkeyKing. It is based on Alibaba's nearly ten years of failure testing and drill practice and combines the best...

gVisor is an application kernel developed by Google that provides a strong layer of isolation between applications and the host operating system. Written in Go, it implements a Linux-compatible system call interface that runs entirely in user space, creating a secure sandboxed environment for containers. Unlike traditional virtual machines or lightweight syscall filters, gVisor follows a third approach that offers many of the security benefits of virtualization while maintaining the speed,...

barco is a project I worked on to learn more about Linux containers and the Linux kernel, based on other guides on the internet. Linux containers are made up by a set of Linux kernel features. namespaces: are used to group kernel objects into different sets that can be accessed by specific process trees. There are different types of namespaces, for example,the PID namespace is used to isolate the process tree, while the network namespace is used to isolate the network stack.

lmctfy is Google’s open-source container runtime that exposed Linux cgroups and namespaces through a higher-level API, predating the widespread adoption of modern container tools. It offered a daemon and client for creating, updating, and destroying resource-isolated “containers” with quotas on CPU, memory, and other subsystems. The project focused on operational safety—clean hierarchies, accounting, and predictable behavior under resource pressure—reflecting lessons from running containers...