NVIDIA/enroot

Health v2 · maintenance only

Adoption not part of the score

1107 stars · 139 forks observed · 2026-09-23

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Enroot is a command-line tool from NVIDIA that turns traditional container and OS images (such as Docker images) into unprivileged sandboxes on Linux. It acts like an enhanced unprivileged chroot, using user and mount namespaces to provide filesystem separation with little to no isolation overhead, making it well suited for HPC and multi-user environments.

Use cases

• run docker images without root privileges
• convert container images into lightweight sandboxes
• run containers in HPC clusters without isolation overhead
• import docker images quickly for reproducible environments
• give multiple users per-user container environments without setuid
• run GPU workloads inside unprivileged containers
• replace chroot with a modern namespace-based sandbox

When to choose

• you need portability and reproducibility of container images but not strong isolation
• you run HPC or multi-user systems where root daemons and setuid are undesirable
• you want fast Docker image imports and GPU support via libnvidia-container
• you prefer a simple, daemonless, scriptable tool following Unix philosophy

When to avoid

• you need strong security isolation between workloads (use Docker, Podman, or gVisor)
• you need full container orchestration features like networking, cgroups, and resource limits
• you are not on Linux, since it relies on Linux kernel namespaces

Facets

cli-tool · maturity active

container-runtime cli developer-tools security developer-tools self-hosted cli containers hpc unprivileged-sandbox docker-images chroot rootless gpu-support nvidia devops command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="NVIDIA/enroot")