{"id":34767971,"url":"https://github.com/sutantodadang/isolazi","last_synced_at":"2026-04-25T07:04:25.560Z","repository":{"id":330562924,"uuid":"1122248302","full_name":"sutantodadang/isolazi","owner":"sutantodadang","description":"A minimal container runtime written in Zig, inspired by Docker, Podman, and OCI runtimes (runc, crun, youki).","archived":false,"fork":false,"pushed_at":"2026-03-18T07:18:42.000Z","size":415,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-18T23:07:14.481Z","etag":null,"topics":["docker","oci-image","podman","wsl2","zig"],"latest_commit_sha":null,"homepage":"","language":"Zig","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sutantodadang.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-24T10:59:33.000Z","updated_at":"2026-03-18T07:18:10.000Z","dependencies_parsed_at":"2026-01-22T10:01:21.503Z","dependency_job_id":null,"html_url":"https://github.com/sutantodadang/isolazi","commit_stats":null,"previous_names":["sutantodadang/isolazi"],"tags_count":30,"template":false,"template_full_name":null,"purl":"pkg:github/sutantodadang/isolazi","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sutantodadang%2Fisolazi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sutantodadang%2Fisolazi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sutantodadang%2Fisolazi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sutantodadang%2Fisolazi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sutantodadang","download_url":"https://codeload.github.com/sutantodadang/isolazi/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sutantodadang%2Fisolazi/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32253252,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-25T04:23:17.126Z","status":"ssl_error","status_checked_at":"2026-04-25T04:21:53.360Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","oci-image","podman","wsl2","zig"],"created_at":"2025-12-25T07:47:13.572Z","updated_at":"2026-04-25T07:04:25.545Z","avatar_url":"https://github.com/sutantodadang.png","language":"Zig","funding_links":[],"categories":[],"sub_categories":[],"readme":"# isolazi\n\nA minimal container runtime written in Zig, inspired by Docker, Podman, and OCI runtimes (runc, crun, youki).\n\n## Features\n\n 🐳 **Docker-like CLI** - Familiar commands: `run`, `pull`, `ps`, `stop`, `rm`, `exec`, `compose`\n- 📦 **OCI Image Support** - Pull images from Docker Hub and other registries\n- 🔒 **Process Isolation** - Linux namespaces (PID, mount, UTS, IPC, **network**, **user**, **cgroup**)\n- 🛡️ **Seccomp Filtering** - Block dangerous syscalls with configurable profiles\n- 🔐 **AppArmor/SELinux** - Mandatory Access Control for defense-in-depth security\n- 🌐 **Network Isolation** - veth pairs, bridge networking, NAT, and port forwarding\n- 👤 **Rootless Containers** - User namespace support for unprivileged container execution\n- ⚙️ **Resource Limits** - cgroup v2 support for memory, CPU, and I/O limits\n- 🗂️ **Filesystem Isolation** - Using `pivot_root` or `chroot`\n- 🔧 **Exec into Containers** - Execute commands in running containers using `nsenter`\n- 🪟 **Windows Support** - Run containers via WSL2 backend\n 🍎 **macOS Support** - Run containers via Apple Virtualization framework\n 🧩 **Docker Compose** - Multi-container orchestration with `docker-compose.yml` support\n- ⚡ **Fast \u0026 Lightweight** - Written in Zig with minimal dependencies\n\n## Current Status (February 23, 2026)\n\n ✅ **Core commands**: `run`, `build`, `pull`, `images`, `ps`, `create`, `start`, `stop`, `rm`, `exec`, `logs`, `prune`, `update`, `compose`\n- ✅ **Image Builder**: Build images from Isolazifile/Dockerfile (`FROM`, `RUN`, `COPY`, `ADD`, `ENV`, `WORKDIR`, `ARG`, `CMD`, `ENTRYPOINT`)\n- ✅ **Prune behavior**: `prune` removes stopped containers and unused images; `prune -f/--force` removes all containers\n- ✅ **Rootless mode**: `--rootless` with optional `--uid-map`/`--gid-map`\n- ✅ **Networking**: bridge + veth, NAT, port publishing (`-p`)\n- ✅ **Security**: seccomp filtering, AppArmor/SELinux toggles, user namespaces\n- ✅ **Resource limits**: cgroup v2 memory/CPU/I/O/OOM controls\n- ✅ **Platforms**: Linux (native), Windows (WSL2), macOS (Linux VM via Lima/vfkit)\n ✅ **Cross-builds**: targets validated for `x86_64-windows`, `x86_64-linux`, `x86_64-macos`, `aarch64-macos`\n ✅ **Docker Compose**: `compose up`, `down`, `ps`, `logs`, `stop`, `restart`, `pull`, `config` with env var substitution and dependency ordering\n\n## Installation\n\n### Quick Install (Recommended)\n\n**macOS / Linux:**\n```bash\ncurl -fsSL https://raw.githubusercontent.com/sutantodadang/isolazi/main/install.sh | bash\n```\n\nOr clone and run locally:\n```bash\ngit clone https://github.com/sutantodadang/isolazi.git\ncd isolazi\n./install.sh\n```\n\n**Windows (PowerShell as Administrator):**\n```powershell\nirm https://raw.githubusercontent.com/sutantodadang/isolazi/main/install.ps1 | iex\n```\n\nOr clone and run locally:\n```powershell\ngit clone https://github.com/sutantodadang/isolazi.git\ncd isolazi\n.\\install.ps1\n```\n\nThe installer will:\n- ✅ Download pre-built binary from GitHub releases\n- ✅ Auto-detect your platform (macOS/Linux, x86_64/arm64)\n- ✅ Install the binary to `~/.isolazi/bin`\n- ✅ Add to your PATH (supports zsh, bash, fish, PowerShell)\n\n**Install specific version:**\n```bash\n# macOS / Linux\nISOLAZI_VERSION=v0.1.11 curl -fsSL https://raw.githubusercontent.com/sutantodadang/isolazi/main/install.sh | bash\n\n# Windows\n.\\install.ps1 -Version v0.1.11\n```\n\n**Uninstall:**\n```bash\n# macOS / Linux\n./install.sh --uninstall\n\n# Windows\n.\\install.ps1 -Uninstall\n```\n\n### Prerequisites\n\n- [Zig](https://ziglang.org/download/) 0.15.2 or later (auto-installed by script)\n- Linux kernel with namespace support (for native execution)\n- WSL2 (for Windows)\n- macOS 12.0+ with Lima (for macOS)\n\n### Manual Build from Source\n\n```bash\ngit clone https://github.com/sutantodadang/isolazi.git\ncd isolazi\nzig build -Doptimize=ReleaseFast\n```\n\nThe binary will be available at `zig-out/bin/isolazi`.\n\nTo manually add to PATH:\n```bash\n# Bash\necho 'export PATH=\"$PATH:$HOME/.isolazi/bin\"' \u003e\u003e ~/.bashrc\n\n# Zsh\necho 'export PATH=\"$PATH:$HOME/.isolazi/bin\"' \u003e\u003e ~/.zshrc\n\n# Fish\necho 'set -gx PATH $PATH $HOME/.isolazi/bin' \u003e\u003e ~/.config/fish/config.fish\n```\n\n## Quick Start\n\n### Pull an Image\n\n```bash\nisolazi pull alpine:latest\n```\n\n### Build an Image\n\nCreate an `Isolazifile` (or `Dockerfile`):\n```dockerfile\nFROM alpine:latest\nRUN echo \"Hello from Isolazi Build\" \u003e /message.txt\nCMD cat /message.txt\n```\n\nBuild the image:\n```bash\nisolazi build -t my-image:v1 .\n```\n\nThe image will be available locally:\n```bash\nisolazi images\n```\n\nSee [docs/BUILD.md](docs/BUILD.md) for full documentation on supported instructions and options.\n\n### Run a Container\n\n```bash\n# Interactive shell\nisolazi run alpine /bin/sh\n\n# Run a command\nisolazi run alpine echo \"Hello from container!\"\n\n# Run in detached mode\nisolazi run -d alpine sleep 300\n\n# With environment variables\nisolazi run -e MYVAR=hello -e DEBUG=1 alpine env\n\n# With volume mounts\nisolazi run -v /host/data:/container/data alpine ls /container/data\n\n# With port publishing (network namespace enabled by default)\nisolazi run -d -p 8080:80 nginx\n\n# Multiple port mappings\nisolazi run -d -p 8080:80 -p 8443:443 nginx\n\n# UDP port mapping\nisolazi run -d -p 5353:53/udp coredns\n\n# Run PostgreSQL with all options\nisolazi run -d -p 5432:5432 \\\n  -e POSTGRES_PASSWORD=secret,POSTGRES_USER=myuser,POSTGRES_DB=mydb \\\n  -v /mydata:/var/lib/postgresql/data \\\n  postgres:16-alpine\n\n# Rootless containers (no root required)\nisolazi run --rootless alpine /bin/sh\n\n# Rootless with custom UID/GID mapping\nisolazi run --rootless --uid-map 0:1000:1 --gid-map 0:1000:1 alpine /bin/sh\n\n# With resource limits (cgroup v2)\nisolazi run --memory 512m --cpus 2 alpine /bin/sh\n\n# Memory limits\nisolazi run -m 256m alpine stress --vm 1 --vm-bytes 128M\n\n# CPU limits (quota-based)\nisolazi run --cpus 1.5 alpine /bin/sh          # 1.5 CPU cores\nisolazi run --cpu-quota 50000 alpine /bin/sh   # 50% of one CPU\n\n# CPU weight (relative priority)\nisolazi run --cpu-weight 512 alpine /bin/sh    # Lower priority (default: 100)\n\n# I/O weight\nisolazi run --io-weight 50 alpine dd if=/dev/zero of=/tmp/test bs=1M count=100\n\n# OOM configuration\nisolazi run --oom-score-adj 500 alpine /bin/sh       # More likely to be killed\nisolazi run --oom-kill-disable alpine /bin/sh        # Disable OOM killer\n\n# Combine resource limits\nisolazi run -d -m 1g --cpus 2 --io-weight 100 -p 8080:80 nginx\n\n# With seccomp filtering (default: blocks dangerous syscalls)\nisolazi run alpine /bin/sh\n\n# Use minimal seccomp profile for more permissive filtering\nisolazi run --seccomp minimal alpine /bin/sh\n\n# Strict seccomp profile (allowlist mode)\nisolazi run --seccomp strict alpine /bin/sh\n\n# Disable seccomp (for debugging only - NOT recommended)\nisolazi run --no-seccomp alpine /bin/sh\n```\n\n### Container Management\n\n```bash\n# List running containers\nisolazi ps\n\n# List all containers (including stopped)\nisolazi ps -a\n\n# Create a container without starting\nisolazi create --name myapp alpine\n\n# Start a stopped container\nisolazi start myapp\n\n# Stop a running container\nisolazi stop myapp\n\n# Remove a container\nisolazi rm myapp\n\n# Force remove a running container\nisolazi rm -f myapp\n\n# Inspect container details\nisolazi inspect myapp\n\n# Clean up stopped containers and unused images\nisolazi prune\n\n# Force remove all containers and unused images\nisolazi prune -f\n```\n\n### Update Isolazi\n\n```bash\n# Update to the latest version\nisolazi update\n```\n\n### Container Logs\n\n```bash\n# View container logs (stdout and stderr)\nisolazi logs \u003ccontainer_id\u003e\n\n# Follow log output (like tail -f)\nisolazi logs -f \u003ccontainer_id\u003e\n\n# Show last N lines\nisolazi logs --tail 100 \u003ccontainer_id\u003e\nisolazi logs -n 50 \u003ccontainer_id\u003e\n\n# Show timestamps\nisolazi logs -t \u003ccontainer_id\u003e\nisolazi logs --timestamps \u003ccontainer_id\u003e\n\n# Show only stdout or stderr\nisolazi logs --stdout \u003ccontainer_id\u003e\nisolazi logs --stderr \u003ccontainer_id\u003e\n\n# Combine options\nisolazi logs -f --tail 20 -t \u003ccontainer_id\u003e\n```\n\n### Execute Commands in Running Containers\n\n```bash\n# Run an interactive shell in a running container\nisolazi exec -it \u003ccontainer_id\u003e /bin/sh\n\n# Run a command in a running container\nisolazi exec \u003ccontainer_id\u003e ls -la /\n\n# Run command with environment variables\nisolazi exec -e MYVAR=value \u003ccontainer_id\u003e env\n\n# Run command as a different user\nisolazi exec -u nobody \u003ccontainer_id\u003e id\n\n# Run command in a specific working directory\nisolazi exec -w /tmp \u003ccontainer_id\u003e pwd\n\n# Run command in background (detached)\nisolazi exec -d \u003ccontainer_id\u003e sleep 100\n```\n\n### Image Management\n\n```bash\n# List cached images\nisolazi images\n\n# Pull from different registries\nisolazi pull docker.io/library/nginx:latest\nisolazi pull ghcr.io/owner/repo:tag\n```\n\n### Docker Compose\n\nisolazi supports multi-container orchestration using `docker-compose.yml` files.\n\n```yaml\n# docker-compose.yml\nversion: '3'\nservices:\n  web:\n    image: nginx:alpine\n    ports:\n      - \"8080:80\"\n    depends_on:\n      - api\n  api:\n    image: node:18-alpine\n    environment:\n      - DATABASE_URL=postgres://db:5432/myapp\n    depends_on:\n      - db\n  db:\n    image: postgres:16-alpine\n    environment:\n      POSTGRES_PASSWORD: secret\n      POSTGRES_DB: myapp\n    ports:\n      - \"5432:5432\"\n    volumes:\n      - ./data:/var/lib/postgresql/data\n```\n\n```bash\n# Start all services (respects depends_on order)\nisolazi compose up\n\n# Start in detached mode\nisolazi compose up -d\n\n# Use a specific compose file\nisolazi compose -f ./path/to/docker-compose.yml up -d\n\n# View running services\nisolazi compose ps\n\n# View service logs\nisolazi compose logs\nisolazi compose logs -f          # Follow log output\nisolazi compose logs -n 50       # Last 50 lines\n\n# Stop all services\nisolazi compose stop\n\n# Restart all services\nisolazi compose restart\n\n# Stop and remove all containers\nisolazi compose down\n\n# Pull latest images for all services\nisolazi compose pull\n\n# Validate and display compose configuration\nisolazi compose config\n```\n\n**Supported `docker-compose.yml` features:**\n- Service definitions with `image`, `ports`, `environment`, `volumes`, `depends_on`\n- Environment variables as list (`- KEY=VALUE`) or map (`KEY: VALUE`)\n- Variable substitution: `$VAR`, `${VAR}`, `${VAR:-default}`\n- `.env` file loading\n- Topological dependency ordering with cycle detection\n- `command` and `working_dir` overrides\n\n## Usage\n\n```\nisolazi \u003cCOMMAND\u003e [OPTIONS]\n\nCOMMANDS:\n    run [-d] \u003cimage\u003e [command]       Run a command in a new container\n    build [OPTIONS] \u003cpath\u003e           Build an image from an Isolazifile\n    exec [OPTIONS] \u003ccontainer\u003e \u003ccmd\u003e Execute a command in a running container\n    logs [-f] \u003ccontainer\u003e            Display container logs\n    create [--name NAME] \u003cimage\u003e     Create a container without starting\n    start \u003ccontainer\u003e                Start a stopped container\n    stop \u003ccontainer\u003e                 Stop a running container\n    rm [-f] \u003ccontainer\u003e              Remove a container\n    ps [-a]                          List containers\n    inspect \u003ccontainer\u003e              Display container details\n    pull \u003cimage\u003e                     Pull an image from a registry\n    images                           List cached images\n    prune [-f]                       Remove stopped containers and unused images\n    update                           Update isolazi to the latest version\n    version                          Print version information\n    help                             Print this help message\n    compose \u003csubcommand\u003e [OPTIONS]    Multi-container orchestration\n\nOPTIONS for 'build':\n    -f, --file \u003cpath\u003e         Name of the Isolazifile (default: 'Isolazifile')\n    -t, --tag \u003cname\u003e          Name and optionally a tag in the 'name:tag' format\n    --build-arg \u003carg\u003e         Set build-time variables\n    --no-cache                Do not use cache when building the image\n    -q, --quiet               Suppress the build output and print image ID on success\n\nOPTIONS for 'run':\n    -d, --detach              Run container in background\n    -e, --env KEY=VALUE       Set environment variable (comma-separated: KEY1=V1,KEY2=V2)\n    -v, --volume SRC:DST[:ro] Mount a volume (can be repeated)\n    -p, --port HOST:CONTAINER Publish container port to host (can be repeated)\n    --hostname \u003cname\u003e         Set the container hostname\n    --cwd \u003cpath\u003e              Set the working directory\n    --rootless                Run container without root privileges (user namespace)\n    --uid-map C:H:S           Map container UID C to host UID H for S IDs\n    --gid-map C:H:S           Map container GID C to host GID H for S IDs\n    \n    Resource Limits (cgroup v2):\n    -m, --memory \u003csize\u003e       Memory limit (e.g., 512m, 1g, 1073741824)\n    --memory-swap \u003csize\u003e      Swap limit (memory + swap)\n    -c, --cpus \u003cnum\u003e          CPU cores limit (e.g., 2, 0.5, 1.5)\n    --cpu-quota \u003cusec\u003e        CPU quota in microseconds per period\n    --cpu-period \u003cusec\u003e       CPU period (default: 100000)\n    --cpu-weight \u003c1-10000\u003e    CPU weight for scheduling (default: 100)\n    --io-weight \u003c1-10000\u003e     Block I/O weight (default: 100)\n    --oom-score-adj \u003c-1000..1000\u003e  OOM killer score adjustment\n    --oom-kill-disable        Disable OOM killer for this container\n\n    Security Options:\n    --seccomp \u003cprofile\u003e       Seccomp profile: default, minimal, strict, disabled\n    --no-seccomp              Disable seccomp filtering (less secure)\n    --apparmor [profile]      Enable AppArmor with optional profile (default: isolazi-default)\n    --apparmor-mode \u003cmode\u003e    AppArmor mode: enforce, complain, unconfined\n    --no-apparmor             Disable AppArmor restrictions\n    --selinux [context]       Enable SELinux with optional context\n    --selinux-type \u003ctype\u003e     SELinux type: container_t, container_net_t, container_file_t, spc_t\n    --selinux-mcs \u003ccats\u003e      SELinux MCS categories (e.g., c1,c2)\n    --no-selinux              Disable SELinux labeling\n    --security-opt \u003copt\u003e      Security option (Docker-compatible): apparmor=profile, label=context\n    --privileged              Disable all security features (NOT recommended)\n\nOPTIONS for 'exec':\n    -i, --interactive         Keep STDIN open\n    -t, --tty                 Allocate a pseudo-TTY\n    -d, --detach              Run command in background\n    -e, --env KEY=VALUE       Set environment variable\n    -u, --user \u003cuser\u003e         Run command as specified user\n    -w, --workdir \u003cpath\u003e      Working directory inside the container\n\nOPTIONS for 'logs':\n    -f, --follow              Follow log output (stream new logs)\n    -n, --tail \u003cN\u003e            Show last N lines\n    -t, --timestamps          Show timestamps with each line\n    --stdout                  Show only stdout logs\n    --stderr                  Show only stderr logs\n\nOPTIONS for 'ps':\n    -a, --all            Show all containers (default: only running)\n\nOPTIONS for 'rm':\n    -f, --force          Force remove running container\n\nOPTIONS for 'prune':\n    -f, --force          Remove all containers (including running)\n\nOPTIONS for 'compose':\n    -f, --file \u003cpath\u003e         Compose file (default: 'docker-compose.yml')\n\n    SUBCOMMANDS:\n    up [-d]                   Create and start all services\n    down                      Stop and remove all service containers\n    ps                        List running service containers\n    logs [-f] [-n N]          View service logs\n    stop                      Stop all running services\n    restart                   Restart all services\n    pull                      Pull images for all services\n    config                    Validate and display compose configuration\n```\n\n## Image References\n\nisolazi supports standard OCI image references:\n\n| Format | Example | Description |\n|--------|---------|-------------|\n| Short name | `alpine` | Defaults to `docker.io/library/alpine:latest` |\n| With tag | `alpine:3.18` | Specific version |\n| Full reference | `docker.io/library/alpine:3.18` | Complete path |\n| Other registries | `ghcr.io/owner/repo:tag` | GitHub Container Registry |\n\n## Architecture\n\n```\nisolazi/\n├── src/\n│   ├── main.zig          # CLI entry point\n│   ├── root.zig          # Module exports\n│   ├── cli/              # Command-line interface\n│   │   ├── compose.zig  # Docker Compose orchestration\n│   ├── config/           # Container configuration\n│   ├── container/        # Container state management\n│   ├── image/            # OCI image handling\n│   │   ├── cache.zig     # Local image cache\n│   │   ├── layer.zig     # Layer extraction\n│   │   ├── reference.zig # Image reference parsing\n│   │   └── registry.zig  # Registry client\n│   ├── runtime/          # Container runtime (Linux)\n│   │   └── container.zig # Container execution and exec support\n│   ├── linux/            # Linux-specific (namespaces, networking, security)\n│   │   ├── syscalls.zig  # Low-level Linux syscall wrappers (setns, nsenter)\n│   │   ├── network.zig   # Container networking (veth, bridge, NAT)\n│   │   ├── userns.zig    # User namespace for rootless containers\n│   │   ├── cgroup.zig    # cgroup v2 resource limits\n│   │   ├── seccomp.zig   # Seccomp syscall filtering\n│   │   ├── apparmor.zig  # AppArmor MAC profile management\n│   │   └── selinux.zig   # SELinux context and labeling\n│   ├── fs/               # Filesystem operations\n│   ├── windows/          # WSL2 backend (LSM passthrough)\n│   └── macos/            # Lima VM backend (LSM passthrough)\n├── build.zig\n└── build.zig.zon\n```\n\n## Security\n\n### Seccomp Syscall Filtering\n\nIsolazi uses seccomp-bpf to restrict syscalls available inside containers. This provides defense-in-depth against container escapes and privilege escalation.\n\n**Seccomp Profiles:**\n\n| Profile | Description | Use Case |\n|---------|-------------|----------|\n| `default` | Blocks dangerous syscalls (default) | Production containers |\n| `minimal` | Only blocks critical syscalls | When you need more syscalls |\n| `strict` | Allowlist mode - minimal syscalls | High-security environments |\n| `disabled` | No filtering | Debugging only |\n\n**Default Profile Blocked Syscalls:**\n- `mount`, `umount` - Filesystem manipulation\n- `ptrace` - Process tracing/debugging\n- `kexec_load`, `kexec_file_load` - Kernel replacement\n- `reboot` - System reboot\n- `init_module`, `delete_module` - Kernel modules\n- `settimeofday`, `clock_settime` - Time manipulation\n- `sethostname`, `setdomainname` - Hostname changes\n- `pivot_root` - Root filesystem changes\n- `bpf`, `perf_event_open` - Kernel debugging\n- `setns`, `unshare` - Namespace manipulation\n- `open_by_handle_at` - Filesystem escape vector\n\n**Usage Examples:**\n\n```bash\n# Default security (recommended)\nisolazi run alpine /bin/sh\n\n# Minimal profile for applications that need more syscalls\nisolazi run --seccomp minimal alpine /bin/sh\n\n# Strict profile for high-security environments\nisolazi run --seccomp strict alpine /bin/sh\n\n# Disable seccomp for debugging (NOT recommended for production)\nisolazi run --no-seccomp alpine /bin/sh\n```\n\n**How it Works:**\n1. BPF filter is generated from the selected profile\n2. `prctl(PR_SET_NO_NEW_PRIVS)` is set to enable unprivileged seccomp\n3. Filter is installed via `seccomp(SECCOMP_SET_MODE_FILTER)`\n4. Container process and all children are restricted\n\n### AppArmor (Linux Security Module)\n\nAppArmor provides Mandatory Access Control (MAC) to restrict what a container can do. It's particularly effective at preventing file access and capability-based attacks.\n\n**AppArmor Modes:**\n\n| Mode | Description | Use Case |\n|------|-------------|----------|\n| `enforce` | Actively blocks policy violations (default) | Production containers |\n| `complain` | Logs violations without blocking | Testing and debugging |\n| `unconfined` | No restrictions | When AppArmor isn't needed |\n\n**Default Profile Restrictions:**\n- Blocks access to `/proc/kcore`, `/proc/kmem`, `/proc/sysrq-trigger`\n- Blocks `/sys/firmware/**` to prevent firmware tampering\n- Blocks container runtime sockets (`/var/run/docker.sock`, etc.)\n- Denies `CAP_SYS_ADMIN`, `CAP_SYS_PTRACE`, `CAP_SYS_MODULE`\n- Denies raw network access and kernel keyring access\n\n**Usage Examples:**\n\n```bash\n# Enable AppArmor with default profile\nisolazi run --apparmor alpine /bin/sh\n\n# Use a custom AppArmor profile\nisolazi run --apparmor my-profile alpine /bin/sh\n\n# AppArmor in complain mode (log only)\nisolazi run --apparmor --apparmor-mode complain alpine /bin/sh\n\n# Disable AppArmor\nisolazi run --no-apparmor alpine /bin/sh\n\n# Docker-compatible security option\nisolazi run --security-opt apparmor=my-profile alpine /bin/sh\n```\n\n**Platform Support:**\n- **Linux**: Native AppArmor support (requires AppArmor enabled in kernel)\n- **Windows (WSL2)**: Passed through to Linux isolazi inside WSL\n- **macOS (Lima)**: Passed through to Linux VM (if AppArmor is available)\n\n### SELinux (Security-Enhanced Linux)\n\nSELinux provides Type Enforcement (TE) and Multi-Category Security (MCS) for fine-grained access control between containers.\n\n**SELinux Types:**\n\n| Type | Description | Use Case |\n|------|-------------|----------|\n| `container_t` | Standard container type (default) | Most containers |\n| `container_net_t` | Container with network access | Network services |\n| `container_file_t` | Container with file access | Data processing |\n| `spc_t` | Super Privileged Container | System administration |\n\n**MCS Categories:**\nMCS categories (c0-c1023) provide isolation between containers. Each container gets unique categories, preventing one container from accessing another's files.\n\n**Usage Examples:**\n\n```bash\n# Enable SELinux with default context\nisolazi run --selinux alpine /bin/sh\n\n# Use a custom SELinux context\nisolazi run --selinux system_u:system_r:container_t:s0 alpine /bin/sh\n\n# SELinux with specific type\nisolazi run --selinux --selinux-type container_net_t alpine /bin/sh\n\n# SELinux with MCS categories for isolation\nisolazi run --selinux --selinux-mcs c100,c200 alpine /bin/sh\n\n# Disable SELinux\nisolazi run --no-selinux alpine /bin/sh\n\n# Docker-compatible security option\nisolazi run --security-opt label=system_u:system_r:container_t:s0:c100,c200 alpine /bin/sh\n```\n\n**Platform Support:**\n- **Linux**: Native SELinux support (requires SELinux enabled in kernel)\n- **Windows (WSL2)**: Passed through to Linux isolazi inside WSL\n- **macOS (Lima)**: Passed through to Linux VM (if SELinux is available)\n\n### Combining Security Features\n\nFor maximum security, combine multiple security layers:\n\n```bash\n# Full security stack: seccomp + AppArmor + SELinux + resource limits\nisolazi run --seccomp strict \\\n            --apparmor \\\n            --selinux --selinux-mcs c100,c200 \\\n            --memory 512m --cpus 1 \\\n            alpine /bin/sh\n\n# Production-ready secure container\nisolazi run -d -p 8080:80 \\\n            --seccomp default \\\n            --apparmor my-nginx-profile \\\n            --selinux --selinux-type container_net_t \\\n            --memory 256m --cpus 0.5 \\\n            nginx\n\n# Disable all security for debugging (NOT recommended for production)\nisolazi run --privileged alpine /bin/sh\n```\n\n### Security Layers\n\nIsolazi provides multiple security layers:\n\n1. **Namespaces** - Process, mount, network, UTS, IPC, user, cgroup isolation\n2. **Seccomp** - Syscall filtering to block dangerous operations\n3. **AppArmor** - Mandatory Access Control for file and capability restrictions\n4. **SELinux** - Type Enforcement and MCS for inter-container isolation\n5. **Pivot Root** - Complete filesystem isolation\n6. **User Namespace** - Run as non-root on host (rootless containers)\n7. **Cgroups** - Resource limits to prevent DoS\n\n## Network Architecture\n\nContainers use network namespace isolation with bridge networking:\n\n```\n                     Host                          Container\n              ┌─────────────────┐           ┌─────────────────┐\n              │                 │           │                 │\n   eth0 ──────┤   isolazi0      ├───vethXXX─┤   eth0          │\n              │   172.20.0.1    │           │   172.20.0.X    │\n              │   (bridge)      │           │                 │\n              └─────────────────┘           └─────────────────┘\n                     │\n              iptables NAT\n              (MASQUERADE)\n```\n\n\n- **Bridge**: `isolazi0` (172.20.0.1/24) - Created automatically\n- **Container IPs**: 172.20.0.2 - 172.20.0.254 (auto-allocated)\n- **NAT**: Outbound traffic masqueraded via host\n- **Port Forwarding**: DNAT rules for `-p` published ports\n\n## Platform Support\n\n| Platform | Status | Notes |\n|----------|--------|-------|\n| Linux | ✅ Native | Full namespace isolation |\n| Windows | ✅ WSL2 | Containers run in WSL2 |\n| macOS | ✅ Lima | Containers run in Linux VM |\n\n### Windows (WSL2)\n\nOn Windows, isolazi uses WSL2 as the container backend:\n\n1. Images are pulled natively on Windows\n2. Containers are executed inside WSL2 using `unshare` and `chroot`\n3. Requires WSL2 to be installed (`wsl --install`)\n\nOn macOS, isolazi uses [Lima](https://github.com/lima-vm/lima) to run a lightweight Linux VM:\n\n1. Images are pulled natively on macOS\n2. Containers are executed inside a Linux VM with automatic file sharing\n3. Requires macOS 12.0 (Monterey) or later\n4. Needs Lima installed: `brew install lima`\n\n#### macOS VM Management\n\n```bash\n# Check VM status and hypervisor availability\nisolazi vm status\n\n# Show VM configuration\nisolazi vm info\n```\n\n#### macOS Setup\n\n1. Install Lima:\n   ```bash\n   brew install lima\n   ```\n\n2. Lima automatically downloads and manages the Linux VM for isolazi on the first run.\n\n## Data Storage\n\nisolazi stores data in `~/.isolazi/`:\n\n```\n~/.isolazi/\n├── images/\n│   ├── blobs/sha256/     # Content-addressable blob storage\n│   └── manifests/        # Image manifests by registry/repo/tag\n└── containers/\n    └── \u003ccontainer-id\u003e/   # Container state and rootfs\n```\n\n## Security Notes\n\n⚠️ **This is an educational implementation.** For production use, consider:\n\n- ✅ User namespace support (rootless containers) - **Implemented**\n- ✅ Network namespace isolation - **Implemented**\n- ✅ Cgroup v2 resource limits - **Implemented**\n- ✅ Seccomp syscall filtering - **Implemented**\n- ✅ AppArmor profiles - **Implemented**\n- ✅ SELinux labeling - **Implemented**\n\n### Resource Limits (cgroup v2)\n\nisolazi uses Linux cgroup v2 for resource management:\n\n```bash\n# Memory limit - container is killed if exceeded\nisolazi run --memory 256m alpine stress --vm 1 --vm-bytes 512M\n\n# CPU limit - container gets 1.5 CPU cores max\nisolazi run --cpus 1.5 alpine stress --cpu 4\n\n# Combined limits for production workloads\nisolazi run -d -m 1g --cpus 2 --io-weight 100 nginx\n```\n\n**Cgroup v2 Controllers:**\n| Controller | Options | Description |\n|------------|---------|-------------|\n| memory | `-m`, `--memory-swap` | Hard memory limit, swap limit |\n| cpu | `--cpus`, `--cpu-quota`, `--cpu-period`, `--cpu-weight` | CPU quota and scheduling weight |\n| io | `--io-weight` | Block I/O scheduling priority |\n| oom | `--oom-score-adj`, `--oom-kill-disable` | OOM killer behavior |\n\n**Requirements:**\n- Linux kernel 4.15+ with cgroup v2 (unified hierarchy)\n- cgroup v2 mounted at `/sys/fs/cgroup`\n- Root or delegated cgroup permissions\n\n### Rootless Containers\n\nRootless mode uses Linux user namespaces to run containers without requiring root privileges:\n\n```bash\n# Run as unprivileged user (maps your UID to root inside container)\nisolazi run --rootless alpine whoami  # outputs: root\n\n# Custom UID/GID mapping (map container root to host UID 1000)\nisolazi run --rootless --uid-map 0:1000:1 --gid-map 0:1000:1 alpine id\n```\n\n**Benefits:**\n- No root privileges required on the host\n- Container root (UID 0) is mapped to your unprivileged user\n- Improved security isolation\n- Works on Linux, Windows (WSL2), and macOS (Lima)\n\n## Requirements\n\n### Linux\n- Root privileges (CAP_SYS_ADMIN) for namespace creation, OR\n- Use `--rootless` flag for unprivileged execution via user namespaces\n- Kernel with namespace support (user namespace for rootless)\n\n### Windows\n- WSL2 installed and configured\n- Network access for pulling images\n\n### macOS\n- macOS 12.0 (Monterey) or later\n- Lima installed\n- Network access for pulling images\n\n## Benchmarking\n\nisolazi includes a comprehensive benchmark suite for measuring container performance:\n\n```bash\n# Build the benchmark tool\nzig build\n\n# Run all benchmarks\n./zig-out/bin/isolazi-bench all --rootfs /path/to/rootfs --layer /path/to/layer.tar.gz\n\n# Run specific benchmarks\n./zig-out/bin/isolazi-bench container-start --rootfs /path/to/rootfs\n./zig-out/bin/isolazi-bench layer --layer /path/to/layer.tar.gz\n\n# Export results to JSON\n./zig-out/bin/isolazi-bench all -o results.json\n```\n\n**Benchmark Types:**\n- **Cold Container Start** - Time from creation to first process instruction\n- **Memory \u0026 CPU Overhead** - Resource consumption of idle containers\n- **Layer Extraction** - OCI image layer decompression speed\n\nSee [docs/BENCHMARKS.md](docs/BENCHMARKS.md) for detailed documentation.\n\n## Contributing\n\nContributions are welcome! Please feel free to submit issues and pull requests.\n\n## License\n\nApache License 2.0 - see [LICENSE](LICENSE) for details.\n\n## Acknowledgments\n\nInspired by:\n- [Docker](https://www.docker.com/)\n- [Podman](https://podman.io/)\n- [runc](https://github.com/opencontainers/runc)\n- [crun](https://github.com/containers/crun)\n- [youki](https://github.com/containers/youki)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsutantodadang%2Fisolazi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsutantodadang%2Fisolazi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsutantodadang%2Fisolazi/lists"}