sysbox

<p align="center">
    <img alt="sysbox" src="./docs/figures/sysbox-ce-header.png"/>
</p>

<p align="center">
    <a href="https://github.com/nestybox/sysbox/blob/master/LICENSE"><img alt="GitHub license" src="https://img.shields.io/github/license/nestybox/sysbox"></a>
    <a href="https://travis-ci.com/nestybox/sysbox">
    <img src="https://img.shields.io/circleci/project/github/badges/shields/master" alt="build status"></a>
    <a href="https://nestybox-support.slack.com/join/shared_invite/enQtOTA0NDQwMTkzMjg2LTAxNGJjYTU2ZmJkYTZjNDMwNmM4Y2YxNzZiZGJlZDM4OTc1NGUzZDFiNTM4NzM1ZTA2NDE3NzQ1ODg1YzhmNDQ#">
    <img src="https://img.shields.io/badge/chat-on%20slack-FF3386"></a>
</p>

## Introduction

**Sysbox** is an open-source and free container runtime (a specialized "runc"),
originally developed by Nestybox ([acquired by Docker][docker-acquisition] on
05/2022), that enhances containers in two key ways:

*   **Improves container isolation:**

    *   Linux user-namespace on all containers (i.e., root user in the container
        has zero privileges on the host).

    *   Virtualizes portions of procfs & sysfs inside the container.

    *   Hides host info inside the container.

    *   Locks the container's initial mounts, and more.

*   **Enables containers to run same workloads as VMs**:

    *   With Sysbox, containers can run system-level software such as systemd,
        Docker, Kubernetes, K3s, buildx (including multi-arch builds), legacy
        apps, multi-arch apps, and more seamlessly & securely.

    *   This software can run inside Sysbox containers without modification and
        without using special versions of the software (e.g., rootless
        variants).

    *   No privileged containers, no complex images, no tricky entrypoints, no
        special volume mounts, etc.

Think of it as a **"container supercharger"**: it enables your existing container
managers / orchestrators (e.g., Docker, Kubernetes, etc.) to deploy containers
that have hardened isolation and can run almost any workload that runs in VMs.

Sysbox does this by making the container resemble a VM-like environment as much
as possible, using advanced OS virtualization techniques.

Unlike alternative runtimes such as Kata and KubeVirt, **it does not use VMs**.
This makes it easier to use (particularly in cloud environments by avoiding
nested virtualization), although it does not provide the level of isolation
that VM-based runtimes do. See [here](#comparison-to-related-technologies) for a
comparison.

There is no need to learn new tools or modify your existing container images or
workflows to take advantage of Sysbox. Simply install it and point your container
manager / orchestrator to it to deploy enhanced containers.

Sysbox can live side-by-side with other container runtimes on the same host
(e.g., the default OCI runc, Kata, etc.) You can easily choose which containers
or pods to run with each, depending on your needs.

## Demo Videos

*   ["VM-like" containers wit