sysbox

, Docker, K8s, K3s, and more. This enables containers to replace slower/less-efficient VMs in many scenarios. Prior to Sysbox this required insecure privileged containers, custom images, and special host mounts, or specialized tools like LXD, KinD and Minikube. With Sysbox, the container runtime sets up the container such that it can run the software securely and seamlessly, increasing security and reducing complexity. Up to recently Sysbox only worked under Docker, but the latest release (v0.4.0) now works under Kubernetes too. This means you can use Kubernetes to orchestrate pods that are rootless (i.e., root in the container maps to an unprivileged user on the host) and can run not just microservices, but full "VM-like" environments. For example, you can create a pod that acts as a well isolated dev environment and inside of it run systemd, your favorite editor, plus Docker. Or create several pods that together form another K8s cluster for testing. Or run the K8s.io KinD inside a pod to create an entire K8s cluster inside one pod. Many interesting and powerful combinations are possible. Sysbox has taken 2-years of very hard work, as it pushes the limits of OS virtualization (uid-shifting, syscall trapping, procfs virtualization, etc.) It was forked from the OCI runc in 2019, so we stand on the shoulders of the developers of that excellent project. Would love to hear your feedback, if you think this new feature is useful, and for which use-cases. Would also encourage you to try it, we think you'll find it useful. Thanks! - Cesar & Rodny Sysbox: https://github.com/nestybox/sysbox Nestybox: https://www.nestybox.com/