Linux > Containers
Contents
Specifications
This project is where the Open Container Initiative Specifications are written. This is a work in progress.
Containers
rkt (pronounced "rock-it") is a CLI for running app containers on Linux. rkt is designed to be composable, secure, and fast. Based on AppC specification.
runc is a CLI tool for spawning and running containers according to the OCS specification.
LXC is the well known set of tools, templates, library and language bindings. It's pretty low level, very flexible and covers just about every containment feature supported by the upstream kernel.
Vagga is a fully-userspace container engine inspired by Vagrant and Docker, specialized for development environments.
Libct is a containers management library which provides convenient API for frontend programs to rule a container during its whole lifetime.
The main goal of Porto is to create a convenient, reliable interface over several Linux kernel mechanism such as cgroups, namespaces, mounts, networking etc.
A basic user tool to execute simple containers in batch or interactive systems without root privileges.
LMCTFY is the open source version of Google’s container stack, which provides Linux application containers.
Intel Clear Linux OCI (Open Containers Initiative) compatible runtime.
Railcar is a rust implementation of the opencontainers initiative's runtime spec. It is similar to the reference implementation runc, but it is implemented completely in rust for memory safety without needing the overhead of a garbage collector or multiple threads.
Firecracker runs workloads in lightweight virtual machines, called microVMs, which combine the security and isolation properties provided by hardware virtualization technology with the speed and flexibility of containers.
Clouds
Operating Systems
Hypervisors
Sandboxes
NsJail is a process isolation tool for Linux. It makes use of the namespacing, resource control, and seccomp-bpf syscall filter subsystems of the Linux kernel.
Partial Access
Filesystem
Work with remote images registries - retrieving information, images, signing content.
Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.
Command line utility designed to build and to configure at runtime App Containers Images (ACI) and App Container Pods (POD) based on convention over configuration.
Whaler is designed to reverse engineer a Docker Image into the Dockerfile that created it.
Go library and CLIs for working with container registries.
Dashboard
Security
Tools
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement and enforcement of security baselines.
Drydock provides a flexible way of assessing the security of your Docker daemon configuration and containers using editable audit templates.
A proxy for docker.sock that enforces access control and isolated privileges.
gVisor is a user-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.