rootless-containers/rootlesskit

Health v2 · maintenance only

Adoption not part of the score

1299 stars · 126 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RootlessKit is a Linux-native 'fake root' tool that uses user and mount namespaces to let unprivileged users run container engines like Docker and Kubernetes in rootless mode. It also provides network namespace isolation with userspace NAT (slirp) to protect the host's real root from container-breakout attacks.

Use cases

• run docker as an unprivileged user
• run kubernetes without root
• implement rootless containers
• fake root on linux without sudo
• isolate container networking with slirp
• protect host root from container breakouts

When to choose

• you need to run Docker, Podman, or Kubernetes rootless on Linux
• you want user-namespace-based fakeroot with network isolation support
• you need better security isolation than LD_PRELOAD or ptrace-based tools like fakeroot or proot

When to avoid

• you are not on Linux, since it depends on user_namespaces
• you only need simple fakeroot for package builds, where classic fakeroot suffices
• your kernel or environment does not support unprivileged user namespaces or subuid/subgid setup

Facets

cli-tool · maturity active

security container-runtime networking cli security self-hosted cli rootless-containers user-namespaces fakeroot container-security slirp containers devops linux docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rootless-containers/rootlesskit")