Search Results for "space"

gVisor is an application kernel developed by Google that provides a strong layer of isolation between applications and the host operating system. Written in Go, it implements a Linux-compatible system call interface that runs entirely in user space, creating a secure sandboxed environment for containers. Unlike traditional virtual machines or lightweight syscall filters, gVisor follows a third approach that offers many of the security benefits of virtualization while maintaining the speed, resource efficiency, and flexibility of containers. Its key runtime, runsc, integrates seamlessly with container ecosystems such as Docker and Kubernetes, making it easy to deploy sandboxed workloads using familiar tools. ...

Pico is a Git-driven task runner built to facilitate GitOps and Infrastructure-as-Code while securely passing secrets to tasks. What once was a place to chat and collaborate with people across the planet is now a platform for the commercialization of products and services. At the seat of the modern web is the browser. The modern browser is very much like an operating system, both in terms of complexity and code size. Only massive corporations can build and maintain it. Further, the web...

CRFS is a user-space filesystem that mounts container images directly from remote registries, exposing them as ordinary directories without a full “pull” step. Instead of downloading entire layers upfront, it fetches file ranges on demand and maintains a content-addressed cache, yielding fast startup and lower bandwidth for large images. The system speaks registry protocols and understands layered image formats, resolving whiteouts and overlays so the mounted view matches what a container runtime would see. ...

Simplified container management system with shared compressed templates, backups, firewall management, and secure defaults.

novm is an experimental, minimalist virtual machine monitor that explores running Linux guests with a streamlined user-space control plane. Its goal is fast, scriptable VM lifecycle management—boot, snapshot, pause, resume—without the heft of a full cloud stack. The design favors small, understandable code paths around KVM and tap networking so developers can reason about isolation and performance trade-offs. It showcases patterns like process-per-VM supervision, concise configuration, and direct mapping of devices needed for common development workloads. ...