{"id":13521363,"url":"https://github.com/nestybox/sysbox","last_synced_at":"2025-05-14T00:08:06.737Z","repository":{"id":38216007,"uuid":"284555713","full_name":"nestybox/sysbox","owner":"nestybox","description":"An open-source, next-generation \"runc\" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.","archived":false,"fork":false,"pushed_at":"2025-05-03T16:43:29.000Z","size":114543,"stargazers_count":3047,"open_issues_count":165,"forks_count":171,"subscribers_count":41,"default_branch":"master","last_synced_at":"2025-05-09T03:11:47.835Z","etag":null,"topics":["container-runtime-security","container-runtimes","containers","devops","docker","kubernetes"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nestybox.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-02T22:52:36.000Z","updated_at":"2025-05-09T02:52:23.000Z","dependencies_parsed_at":"2023-02-10T13:15:29.754Z","dependency_job_id":"e950c425-262d-48b5-b6be-f7a14721e5d1","html_url":"https://github.com/nestybox/sysbox","commit_stats":{"total_commits":1822,"total_committers":31,"mean_commits":"58.774193548387096","dds":0.5801317233809001,"last_synced_commit":"d61db2575c197fc8d37b54efb25027f454b75c17"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nestybox%2Fsysbox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nestybox%2Fsysbox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nestybox%2Fsysbox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nestybox%2Fsysbox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nestybox","download_url":"https://codeload.github.com/nestybox/sysbox/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254043913,"owners_count":22005037,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container-runtime-security","container-runtimes","containers","devops","docker","kubernetes"],"created_at":"2024-08-01T06:00:33.376Z","updated_at":"2025-05-14T00:08:01.724Z","avatar_url":"https://github.com/nestybox.png","language":"Shell","readme":"\u003cp align=\"center\"\u003e\n    \u003cimg alt=\"sysbox\" src=\"./docs/figures/sysbox-ce-header.png\"/\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://github.com/nestybox/sysbox/blob/master/LICENSE\"\u003e\u003cimg alt=\"GitHub license\" src=\"https://img.shields.io/github/license/nestybox/sysbox\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://travis-ci.com/nestybox/sysbox\"\u003e\n    \u003cimg src=\"https://img.shields.io/circleci/project/github/badges/shields/master\" alt=\"build status\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://nestybox-support.slack.com/join/shared_invite/enQtOTA0NDQwMTkzMjg2LTAxNGJjYTU2ZmJkYTZjNDMwNmM4Y2YxNzZiZGJlZDM4OTc1NGUzZDFiNTM4NzM1ZTA2NDE3NzQ1ODg1YzhmNDQ#\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/chat-on%20slack-FF3386\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n## Introduction\n\n**Sysbox** is an open-source and free container runtime (a specialized \"runc\"),\noriginally developed by Nestybox ([acquired by Docker][docker-acquisition] on\n05/2022), that enhances containers in two key ways:\n\n*   **Improves container isolation:**\n\n    *   Linux user-namespace on all containers (i.e., root user in the container\n        has zero privileges on the host).\n\n    *   Virtualizes portions of procfs \u0026 sysfs inside the container.\n\n    *   Hides host info inside the container.\n\n    *   Locks the container's initial mounts, and more.\n\n*   **Enables containers to run same workloads as VMs**:\n\n    *   With Sysbox, containers can run system-level software such as systemd,\n        Docker, Kubernetes, K3s, buildx, legacy apps, and more seamlessly \u0026\n        securely.\n\n    *   This software can run inside Sysbox containers without modification and\n        without using special versions of the software (e.g., rootless\n        variants).\n\n    *   No privileged containers, no complex images, no tricky entrypoints, no\n        special volume mounts, etc.\n\nThink of it as a **\"container supercharger\"**: it enables your existing container\nmanagers / orchestrators (e.g., Docker, Kubernetes, etc.) to deploy containers\nthat have hardened isolation and can run almost any workload that runs in VMs.\n\nSysbox does this by making the container resemble a VM-like environment as much\nas possible, using advanced OS virtualization techniques.\n\nUnlike alternative runtimes such as Kata and KubeVirt, **it does not use VMs**.\nThis makes it easier to use (particularly in cloud environments by avoiding\nnested virtualization), although it does not provide the level of isolation\nthat VM-based runtimes do. See [here](#comparison-to-related-technologies) for a\ncomparison.\n\nThere is no need to learn new tools or modify your existing container images or\nworkflows to take advantage of Sysbox. Simply install it and point your container\nmanager / orchestrator to it to deploy enhanced containers.\n\nSysbox can live side-by-side with other container runtimes on the same host\n(e.g., the default OCI runc, Kata, etc.) You can easily choose which containers\nor pods to run with each, depending on your needs.\n\n## Demo Videos\n\n*   [\"VM-like\" containers with Docker + Sysbox](https://asciinema.org/a/kkTmOxl8DhEZiM2fLZNFlYzbo?speed=2)\n\n*   [Rootless Kubernetes pods with Sysbox](https://asciinema.org/a/401488?speed=1.5)\n\n## Contents\n\n*   [License](#license)\n*   [Relationship to Nestybox \u0026 Docker](#relationship-to-nestybox--docker)\n*   [Motivation](#motivation)\n*   [How it Works](#how-it-works)\n*   [Comparison to Related Technologies](#comparison-to-related-technologies)\n*   [Audience](#audience)\n*   [Sysbox Enterprise Edition](#sysbox-enterprise-edition)\n*   [Sysbox Features](#sysbox-features)\n*   [System Containers](#system-containers)\n*   [Installation](#installation)\n*   [Using Sysbox](#using-sysbox)\n*   [Documentation](#documentation)\n*   [Performance](#performance)\n*   [Under the Covers](#under-the-covers)\n*   [Contributing](#contributing)\n*   [Security](#security)\n*   [Troubleshooting \u0026 Support](#troubleshooting--support)\n*   [Uninstallation](#uninstallation)\n*   [Roadmap](#roadmap)\n*   [Contact](#contact)\n*   [Thank You](#thank-you)\n\n## License\n\nSysbox is free and open-source, licensed under the Apache License,\nVersion 2.0. See the [LICENSE](LICENSE) file for details.\n\n## Relationship to Nestybox \u0026 Docker\n\nSysbox was originally developed by Nestybox. As [Nestybox is now part of\nDocker][docker-acquisition], Docker is the main sponsor of the Sysbox project.\n\nHaving said this, Sysbox is a community open-source project and it's **not\nofficially supported by Docker** (i.e., Docker subscriptions do not include\nSysbox support).  Support is provided on a **best effort basis** via this Github\nrepo or via the [Sysbox Slack Workspace][slack].\n\nWe encourage participation from the community to help evolve and improve Sysbox,\nwith the goal of increasing the use cases and benefits it enables. External\nmaintainers and contributors are welcomed.\n\n## Motivation\n\nSysbox solves problems such as:\n\n*   Enhancing the isolation of containerized microservices\n    (root in the container maps to an unprivileged user on the host).\n\n*   Enabling a highly capable root user inside the container without\n    compromising host security.\n\n*   Securing CI/CD pipelines by enabling Docker-in-Docker (DinD) or\n    Kubernetes-in-Docker (KinD) without insecure privileged containers\n    or host Docker socket mounts.\n\n*   Enabling the use of containers as \"VM-like\" environments for development,\n    local testing, learning, etc., with strong isolation and the ability\n    to run systemd, Docker, IDEs, and more inside the container.\n\n*   Running legacy apps inside containers (instead of less efficient VMs).\n\n*   Replacing VMs with an easier, faster, more efficient, and more portable\n    container-based alternative, one that can be deployed across cloud\n    environments easily.\n\n*   Partitioning bare-metal hosts into multiple isolated compute environments\n    with 2X the density of VMs (i.e., deploy twice as many VM-like containers\n    as VMs on the same hardware at the same performance).\n\n*   Partitioning cloud instances (e.g., EC2, GCP, etc.) into multiple isolated\n    compute environments without resorting to expensive nested virtualization.\n\n## How it Works\n\n\u003cp align=\"center\"\u003e\n    \u003cimg alt=\"sysbox\" src=\"./docs/figures/sysbox-diagram.png\"/\u003e\n\u003c/p\u003e\n\nSysbox [installs easily](#installation) on Linux hosts (bare-metal, VM, on-prem, cloud, etc.). It\nworks on all mayor cloud-based IaaS and Kubernetes services (e.g., EC2, GCP, GKE,\nEKS, AKS, Rancher, etc.)\n\nOnce installed, Sysbox works under the covers: you use Docker, Kubernetes, etc.\nto deploy containers with it.\n\nFor example, this simple Docker command creates a container with Sysbox:\n\n    $ docker run --runtime=sysbox-runc -it any_image\n\nYou get a well isolated container capable of seamlessly running microservices as\nwell as system-level software that normally that runs on VMs (e.g., systemd,\nDocker, Kubernetes, etc).\n\nMore on how to use Sysbox [here](#using-sysbox).\n\n## Comparison to Related Technologies\n\n\u003cp align=\"center\"\u003e\n    \u003cimg alt=\"sysbox\" src=\"./docs/figures/sysbox-comparison.png\"/\u003e\n\u003c/p\u003e\n\nAs shown, Sysbox enables unprivileged containers to run system-level workloads\nsuch as systemd, Docker, Kubernetes, etc., seamlessly, while giving you a\nbalanced approach between container isolation, performance, efficiency, and\nportability.\n\nAnd it does this with minimal configuration changes to your existing infra: just\ninstall Sysbox and configure your container manager/orchestrator to launch\ncontainers with it, using the image of your choice.\n\nNote that while Sysbox hardens the isolation of standard containers and voids\nthe need for insecure privileged containers in many scenarios, it does not (yet)\nprovide the same level of isolation as VM-based alternatives or user-space OSes\nlike gVisor. Therefore, for scenarios where the highest level of isolation is\nrequired, alternatives such as KubeVirt may be preferable (at the expense of\nlower performance and efficiency and higher complexity and cost).\n\nSee this [blog post](https://blog.nestybox.com/2020/10/06/related-tech-comparison.html) for\nmore.\n\n## Audience\n\nThe Sysbox project is intended for anyone looking to experiment, invent, learn,\nand build systems using [system containers](#system-containers). It's\ncutting-edge OS virtualization, and contributions are welcomed.\n\n## Sysbox Enterprise Edition [DEPRECATED]\n\nPrior to the [acquisition by Docker][docker-acquisition] on 05/2022, Nestybox\noffered [Sysbox Enterprise][sysbox-ee-repo] as an enhanced version of Sysbox\n(e.g., more security, more workloads, and official support).\n\nAfter the acquisition however, Sysbox Enterprise is no longer offered as a\nstandalone product but has instead been incorporated into [Docker Desktop](https://www.docker.com/products/docker-desktop/)\n(see [Docker Hardened Desktop](https://docs.docker.com/desktop/hardened-desktop/)).\n\n**NOTE:** As Sysbox Enterprise is no longer offered as a standalone product, Docker\nplans to make some Sysbox Enterprise features available in Sysbox Community\nEdition. The features are TBD and [your feedback](#contact) on this is welcome.\n\n## Sysbox Features\n\nThe table below summarizes the key features of the Sysbox container runtime.\n\nIt also provides a comparison between the Sysbox Community Edition (i.e., this\nrepo) and the previously available Sysbox Enterprise Edition (now deprecated).\n\n\u003cp align=\"center\"\u003e\n    \u003cimg alt=\"sysbox\" src=\"./docs/figures/sysbox-features.png\" width=\"1000\" /\u003e\n\u003c/p\u003e\n\nMore on the Sysbox features [here](docs/user-guide/features.md).\n\nIf you have questions, you can reach us [here](#contact).\n\n## System Containers\n\nWe call the containers deployed by Sysbox **system containers**, to highlight the\nfact that they can run not just micro-services (as regular containers do), but\nalso system software such as Docker, Kubernetes, Systemd, inner containers, etc.\n\nMore on system containers [here](docs/user-guide/concepts.md#system-container).\n\n## Installation\n\n### Host Requirements\n\nThe Sysbox host must meet the following requirements:\n\n*   It must be running one of the [supported Linux distros](docs/distro-compat.md)\n    and be a machine with a [supported architecture](docs/arch-compat.md) (e.g., amd64, arm64).\n\n*   We recommend a minimum of 4 CPUs (e.g., 2 cores with 2 hyperthreads) and 4GB\n    of RAM. Though this is not a hard requirement, smaller configurations may\n    slow down Sysbox.\n\n### Installing Sysbox\n\nThe method of installation depends on the environment where Sysbox will be\ninstalled:\n\n*   To install Sysbox on a Kubernetes cluster, use the [sysbox-deploy-k8s daemonset](docs/user-guide/install-k8s.md).\n\n*   Otherwise, use the [Sysbox package](docs/user-guide/install-package.md) for\n    your distro.\n\n*   Alternatively, if a package for your distro is not yet available, or if you\n    want to get the latest changes from upstream, you can [build and install Sysbox from source](docs/developers-guide/README.md).\n\n## Using Sysbox\n\nOnce Sysbox is installed, you create a container using your container manager\nor orchestrator (e.g., Docker or Kubernetes) and an image of your choice.\n\nDocker command example:\n\n```console\n$ docker run --runtime=sysbox-runc --rm -it --hostname my_cont registry.nestybox.com/nestybox/ubuntu-bionic-systemd-docker\nroot@my_cont:/#\n```\n\nKubernetes pod spec example:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: ubu-bio-systemd-docker\n  annotations:\n    io.kubernetes.cri-o.userns-mode: \"auto:size=65536\"\nspec:\n  runtimeClassName: sysbox-runc\n  containers:\n  - name: ubu-bio-systemd-docker\n    image: registry.nestybox.com/nestybox/ubuntu-bionic-systemd-docker\n    command: [\"/sbin/init\"]\n  restartPolicy: Never\n```\n\nYou can choose whatever container image you want, Sysbox places no requirements\non the image.\n\nNestybox makes several reference images available in its [Dockerhub](https://hub.docker.com/u/nestybox)\nand [GitHub Container Registry](https://github.com/orgs/nestybox/packages) repos. These are\nimages that typically include systemd, Docker, Kubernetes, and more inside the containers.\nThe Dockerfiles are [here](https://github.com/nestybox/dockerfiles/tree/master). Feel free\nto use and modify per your needs.\n\n## Documentation\n\nWe strive to provide good documentation; it's a key component of the Sysbox project.\n\nWe have several documents to help you get started and get the best out of\nSysbox.\n\n*   [Sysbox Distro Compatibility Doc](docs/distro-compat.md)\n\n    *   Distro compatibility requirements. Check this out before installing Sysbox.\n\n*   [Sysbox Quick Start Guide](docs/quickstart/README.md)\n\n    *   Provides many examples for using Sysbox. New users should start here.\n\n*   [Sysbox User Guide](docs/user-guide/README.md)\n\n    *   Provides more detailed information on Sysbox installation,\n        configuration, features and design.\n\n*   [Nestybox blog site](https://blog.nestybox.com/)\n\n    *   Articles on using Sysbox to solve real-life problems.\n\n## Performance\n\nSysbox is fast and efficient, as described in this [Nestybox blog post](https://blog.nestybox.com/2020/09/23/perf-comparison.html).\n\nThe containers created by Sysbox have similar performance to those created by\nthe OCI runc (the default runtime for Docker and Kubernetes).\n\nEven containers deployed inside the system containers have excellent\nperformance, thought there is a slight overhead for network IO (as expected\nsince packets emitted by inner containers go through an additional network\ninterface / bridge inside the system container).\n\nNow, if you use Sysbox to deploy system containers that replace VMs, then the\nperformance and efficiency gains are significant: you can deploy 2X as many\nsystem containers as VMs on the same server and get the same performance, and do\nthis with a fraction of the memory and storage consumption. The blog post\nreferenced above has more on this.\n\n## Under the Covers\n\nSysbox was forked from the excellent [OCI runc][oci-runc] in early 2019 and it\nstands on the shoulders of the work done by the OCI runc developers.\n\nHaving said this, Sysbox adds significant functionality on top. It's written in\nGo, and it is currently composed of three components: sysbox-runc, sysbox-fs,\nand sysbox-mgr.\n\nSysbox uses many OS-virtualization features of the Linux kernel and complements\nthese with OS-virtualization techniques implemented in user-space. These include\nusing all Linux namespaces (in particular the user-namespace), partial\nvirtualization of procfs and sysfs, selective syscall trapping, and more.\n\nMore on Sysbox's design can be found in the [Sysbox user guide](docs/user-guide/design.md).\n\n### Sysbox does not use hardware virtualization\n\nThough the containers generated by Sysbox resemble virtual machines in some ways\n(e.g., you can run as root, run multiple services, and deploy Docker and K8s\ninside), Sysbox does **not** use hardware virtualization.\n\nSysbox is a pure OS-virtualization technology meant to create containers that\ncan run applications as well as system-level software, easily and securely.\n\nThis makes the containers created by Sysbox fast, efficient, and portable (i.e.,\nthey aren't tied to a hypervisor).\n\nIsolation wise, it's fair to say that Sysbox containers provide stronger\nisolation than regular Docker containers (by virtue of using the Linux\nuser-namespace and light-weight OS shim), but weaker isolation than VMs (by\nsharing the Linux kernel among containers).\n\n## Contributing\n\nWe welcome contributions to Sysbox, whether they are small documentation changes,\nbug fixes, or feature additions. Please see the [contribution guidelines](CONTRIBUTING.md)\nand [developer's guide](docs/developers-guide/README.md) for more info.\n\n## Security\n\nSee the User Guide's [Security Chapter](docs/user-guide/security.md) for\ninfo on how Sysbox secures containers.\n\nIf you find bugs or issues that may expose a Sysbox vulnerability, please report\nthese by sending an email to security@nestybox.com. Please do not open security\nissues in this repo. Thanks!\n\nIn addition, a few vulnerabilities have recently been found in the Linux kernel\nthat in some cases reduce or negate the enhanced isolation provided by Sysbox\ncontainers. Fortunately they are all fixed in recent Linux kernels. See the\nSysbox User Guide's [Vulnerabilities \u0026 CVEs chapter](docs/user-guide/security-cve.md)\nfor more info, and reach out on the [Sysbox Slack channel][slack] for further questions.\n\n## Troubleshooting \u0026 Support\n\nSupport is currently offered on a best-effort basis.\n\nIf you have a question or comment, we love to hear it. You can reach us at our\n[slack channel][slack] or file an issue on this GitHub repo.\n\nIf you spot a problem with Sysbox, please search the existing\n[issues](https://github.com/nestybox/sysbox/issues) as they may describe the\nproblem and provide a work-around.\n\nCheck also the [Troubleshooting document](docs/user-guide/troubleshoot.md).\n\n## Uninstallation\n\nPrior to uninstalling Sysbox, make sure all containers deployed with it are\nstopped and removed.\n\nThe method of uninstallation depends on the method used to install Sysbox:\n\n*   To uninstall Sysbox on a Kubernetes cluster, follow [these instructions](docs/user-guide/install-k8s.md#uninstallation).\n\n*   Otherwise, to uninstall the Sysbox package, follow [these instructions](docs/user-guide/install-package.md#uninstallation).\n\n*   If Sysbox was built and installed from source, follow [these instructions](docs/developers-guide/build.md#cleanup--uninstall).\n\n## Roadmap\n\nThe following is a list of features in the Sysbox roadmap.\n\nWe list these here so that our users can get a better idea of where we\nare going and can give us feedback on which of these they like best\n(or least).\n\nHere is a short list; the Sysbox issue tracker has many more.\n\n*   Support for more Linux distros.\n\n*   More improvements to procfs and sysfs virtualization.\n\n*   Continued improvements to container isolation.\n\n*   Exposing host devices inside system containers with proper permissions.\n\n## Contact\n\nSlack: [Sysbox Slack Workspace][slack]\n\nEmail: contact@nestybox.com\n\nWe are available from Monday-Friday, 9am-5pm Pacific Time.\n\n## Thank You\n\nWe thank you **very much** for using and/or contributing to Sysbox. We hope you\nfind it interesting and that it helps you use containers in new and more powerful\nways.\n\n[slack]: https://nestybox-support.slack.com/join/shared_invite/enQtOTA0NDQwMTkzMjg2LTAxNGJjYTU2ZmJkYTZjNDMwNmM4Y2YxNzZiZGJlZDM4OTc1NGUzZDFiNTM4NzM1ZTA2NDE3NzQ1ODg1YzhmNDQ#/\n\n[perf-blog]: https://blog.nestybox.com/2020/09/23/perf-comparison.html\n\n[oci-runc]: https://github.com/opencontainers/runc\n\n[sysbox-ee-repo]: https://github.com/nestybox/sysbox-ee\n\n[docker-acquisition]: https://www.docker.com/blog/docker-advances-container-isolation-and-workloads-with-acquisition-of-nestybox/\n\n[docker-desktop]: https://www.docker.com/products/\n","funding_links":[],"categories":["Shell","Containers","Runtime","Tools","kubernetes","Runtime level security","工具：覆盖攻防全流程的实用利器"],"sub_categories":["Container Runtime","1. 容器运行时（增强隔离，降低逃逸风险）"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnestybox%2Fsysbox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnestybox%2Fsysbox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnestybox%2Fsysbox/lists"}