nowfound

Dev tools · July 27, 2021

RC

Rootless Containers/Pods that run systemd, Docker, and even Kubernetes

Hi HN, this is Cesar and Rodny, developers of an open-source container runtime called Sysbox, and co-founders of a startup called Nestybox (YC S20). We launched on HN almost a year ago and got excellent feedback then (https://news.ycombinator.com/item?id=24084758). Happy to say that over the past year, Sysbox has continued to gain traction, particularly for securing containers in production, CI/CD, and containerized dev environments. We wanted to announce an important new feature: integration between Sysbox and Kubernetes. As a quick refresher, Sysbox is a "runc" that…

Alternatives

What it does

In the maker’s words, at launch

Hi HN, this is Cesar and Rodny, developers of an open-source container runtime called Sysbox, and co-founders of a startup called Nestybox (YC S20). We launched on HN almost a year ago and got excellent feedback then (https://news.ycombinator.com/item?id=24084758). Happy to say that over the past year, Sysbox has continued to gain traction, particularly for securing containers in production, CI/CD, and containerized dev environments. We wanted to announce an important new feature: integration between Sysbox and Kubernetes. As a quick refresher, Sysbox is a "runc" that enhances containers in two key ways: 1) Hardens container isolation (Linux user-namespace on all containers, partial procfs & sysfs virtualization, initial mount locking, and more). 2) Enables containers to run not just microservices, but also system software such as systemd, Docker, K8s, K3s, and more. This enables containers to replace slower/less-efficient VMs in many scenarios. Prior to Sysbox this required insecure privileged containers, custom images, and special host mounts, or specialized tools like LXD, KinD and Minikube. With Sysbox, the container runtime sets up the container such that it can run the software securely and seamlessly, increasing security and reducing complexity. Up to recently Sysbox only worked under Docker, but the latest release (v0.4.0) now works under Kubernetes too. This means you can use Kubernetes to orchestrate pods that are rootless (i.e., root in the container maps to an unprivileged user on the host) and can run not just microservices, but full "VM-like" environments. For example, you can create a pod that acts as a well isolated dev environment and inside of it run systemd, your favorite editor, plus Docker. Or create several pods that together form another K8s cluster for testing. Or run the K8s.io KinD inside a pod to create an entire K8s cluster inside one pod. Many interesting and powerful combinations are possible. Sysbox has taken 2-years of very hard work, as it pushes the limits of OS virtualization (uid-shifting, syscall trapping, procfs virtualization, etc.) It was forked from the OCI runc in 2019, so we stand on the shoulders of the developers of that excellent project. Would love to hear your feedback, if you think this new feature is useful, and for which use-cases. Would also encourage you to try it, we think you'll find it useful. Thanks! - Cesar & Rodny Sysbox: https://github.com/nestybox/sysbox Nestybox: https://www.nestybox.com/

Does the same job

all alternatives →
  • Google Cloud Run2019 · ▲98

    Bringing serverless to containers

  • KeystoneMar 2026 · ▲125

    Teach your repo how to run itself

  • zeroApr 2026 · ▲94

    One command to deploy Docker containers to your own server

  • VQ
    Vas-quod – A minimal Linux container runtime written in Rust2020 · github.com · ▲110
  • LV
    Launch VM workloads securely and instantaneously, without VMs2021 · ▲12

    Hello HN! We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. This is still a WIP, but we wanted to give the community an idea about our approach, its benefits, and various use cases it unlocks. Today, VMs are used to host containers, and make up for the lack of strong security as well as kernel isolation in containers. This work adds this missing security piece in containers. We plan on launching a free private beta soon. Meanwhile, we'd deeply appreciate any feedback, and happy to answer any questions here or on our slack…

  • SY
    Signadot (YC W20): Local Testing with Shared Kubernetes Clusters2023 · signadot.com · ▲8

    Hi again HN, we’re Arjun and Anirudh, founders of Signadot (YC W20). Signadot helps teams developing microservices test their changes using lightweight environments called “Sandboxes”. We use a relatively new approach, using traffic labeling (using OpenTelemetry) and request routing (using a Service Mesh) to isolate environments in a shared Kubernetes cluster. Today, we’re launching a new feature to help developers with local testing of microservices during the iterative development process. When we initially launched in September last year…

More dev tools this month

the category →
  • Dograh▲592

    The open source VAPI alternative

    Dev tools · 25d ago · dograh.com

  • Meridian▲530

    Don't let your work go unnoticed. Get promoted!

    Dev tools · 20d ago · meridiona.com

  • x1▲516

    Lovable for iPhone apps go from idea to App Store

    Dev tools · 11d ago · x1.new

  • The GTM Co-Founder▲402

    Open-source GTM skills for technical founders

    Dev tools · 29d ago · gtmcofounder.com

  • Open-Source eInk Bike Computer▲389

    OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.

    Dev tools · 1d ago · opentrailpaper.com

  • Nuphos▲380

    The AI-Native DevOps Workspace.

    Dev tools · 24d ago · nuphos.ai

Launched alongside, July 2021

the whole month →