# NVIDIA/enroot

A simple yet powerful tool to turn traditional container/OS images into unprivileged sandboxes.

Repository: https://github.com/NVIDIA/enroot
Canonical: https://ross.abutalabs.com/products/enroot
Language: Shell
License: Apache-2.0
License Family: permissive
Last push: 2026-06-09T00:34:35+00:00

## Health v2 (maintenance only)
Score: 89/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 87, longevity 100
- inputs: {"age_days": 2877, "days_push": 86, "days_rel": 86, "gap_med": 30.0, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1093, forks 136 (observed 2026-08-28T04:03:33.668901+00:00)

## What it is
Enroot is a command-line tool from NVIDIA that turns traditional container and OS images (such as Docker images) into unprivileged sandboxes on Linux. It acts like an enhanced unprivileged chroot, using user and mount namespaces to provide filesystem separation with little to no isolation overhead, making it well suited for HPC and multi-user environments.

## Use cases
- run docker images without root privileges
- convert container images into lightweight sandboxes
- run containers in HPC clusters without isolation overhead
- import docker images quickly for reproducible environments
- give multiple users per-user container environments without setuid
- run GPU workloads inside unprivileged containers
- replace chroot with a modern namespace-based sandbox

## When to choose
- you need portability and reproducibility of container images but not strong isolation
- you run HPC or multi-user systems where root daemons and setuid are undesirable
- you want fast Docker image imports and GPU support via libnvidia-container
- you prefer a simple, daemonless, scriptable tool following Unix philosophy

## When to avoid
- you need strong security isolation between workloads (use Docker, Podman, or gVisor)
- you need full container orchestration features like networking, cgroups, and resource limits
- you are not on Linux, since it relies on Linux kernel namespaces

## Facets
- artifact type: cli-tool
- maturity: active
- function: container-runtime, cli, developer-tools, security
- domain: developer-tools, self-hosted
- platform: cli
- tags: containers, hpc, unprivileged-sandbox, docker-images, chroot, rootless, gpu-support, nvidia, devops, command-line, linux

## Member repositories
- NVIDIA/enroot (main) score 89

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:33.668901+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:47:39.832448+00:00, confidence not recorded.
  - readme: https://github.com/NVIDIA/enroot (fetched 2026-08-28T04:03:33.668901+00:00, sha cd46baa927e1)
- Data as of 2026-08-30T08:39:29.467469+00:00.