Open Source C++ Container Management Software

gVisor is an application kernel developed by Google that provides a strong layer of isolation between applications and the host operating system. Written in Go, it implements a Linux-compatible system call interface that runs entirely in user space, creating a secure sandboxed environment for containers. Unlike traditional virtual machines or lightweight syscall filters, gVisor follows a third approach that offers many of the security benefits of virtualization while maintaining the speed, resource efficiency, and flexibility of containers. Its key runtime, runsc, integrates seamlessly with container ecosystems such as Docker and Kubernetes, making it easy to deploy sandboxed workloads using familiar tools. By intercepting and safely handling syscalls from applications, gVisor reduces the attack surface of the host kernel, mitigating risks associated with running untrusted or potentially malicious code in containerized environments.

Netis Cloud Probe (Packet Agent, name used before)is an open source project to deal with such a situation: it captures packets on Machine A but has to use them on Machine B. This case is very common when you try to monitor network traffic in the LAN.

Pixie is an open-source observability tool for Kubernetes applications. Use Pixie to view the high-level state of your cluster (service maps, cluster resources, application traffic) and also drill down into more detailed views (pod state, flame graphs, individual full-body application requests). Pixie uses eBPF to automatically collect telemetry data such as full-body requests, resource and network metrics, application profiles, and more. Pixie collects, stores and queries all telemetry data locally in the cluster. Pixie uses less than 5% of cluster CPU and in most cases less than 2%. PxL, Pixie’s flexible Pythonic query language, can be used across Pixie’s UI, CLI, and client APIs.

lmctfy is Google’s open-source container runtime that exposed Linux cgroups and namespaces through a higher-level API, predating the widespread adoption of modern container tools. It offered a daemon and client for creating, updating, and destroying resource-isolated “containers” with quotas on CPU, memory, and other subsystems. The project focused on operational safety—clean hierarchies, accounting, and predictable behavior under resource pressure—reflecting lessons from running containers at scale. Although it has since been archived in favor of the broader ecosystem, the code remains a reference for how to map kernel primitives to service-oriented container management. Its design encouraged explicit ownership of resources and stable container identities, which simplified monitoring and policy enforcement. Engineers studying container history use it to understand early patterns that informed today’s runtimes.