Download
An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, and Kubernetes, just like VMs. Think of it as a "container supercharger": it enables your existing container managers/orchestrators (e.g., Docker, Kubernetes, etc.) to deploy containers that have hardened isolation and can run almost any workload that runs in VMs. Sysbox does this by making the container resemble a VM-like environment as much as possible, using advanced OS virtualization techniques. Unlike alternative runtimes such as Kata and KubeVirt, it does not use VMs. This makes it easier to use (particularly in cloud environments by avoiding nested virtualization), although it does not provide the level of isolation that VM-based runtimes do.
Features
- Linux user-namespace on all containers (i.e., root user in the container has zero privileges on the host)
- Virtualizes portions of procfs & sysfs inside the container
- Hides host info inside the container
- Locks the container's initial mounts, and more
- Enables containers to run same workloads as VMs
- With Sysbox, containers can run system-level software such as systemd, Docker, Kubernetes, K3s, buildx, legacy apps, and more seamlessly & securely
- This software can run inside Sysbox containers without modification and without using special versions of the software (e.g., rootless variants)
- No privileged containers, no complex images, no tricky entrypoints, no special volume mounts, etc.
Project Samples
