nestybox/sysbox

Health v2 · maintenance only

Adoption not part of the score

3840 stars · 226 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Sysbox is an open-source container runtime (a specialized runc) that improves container isolation via Linux user-namespaces and procfs/sysfs virtualization. It enables containers to run VM-like workloads such as systemd, Docker, and Kubernetes without privileged mode or nested virtualization.

Use cases

• run docker inside a container without privileged mode
• run systemd inside containers securely
• run kubernetes or k3s inside rootless containers
• harden container isolation with user namespaces
• build multi-arch images inside containers
• replace VMs with secure VM-like containers in CI

When to choose

• you need Docker-in-Docker or systemd in containers without privileged containers
• you want stronger isolation than default runc without nested virtualization
• you run multi-tenant container workloads on shared hosts

When to avoid

• you need VM-grade isolation (use Kata or KubeVirt instead)
• you only run simple stateless microservices with default runc
• your host OS or kernel does not meet Sysbox requirements

Facets

application · maturity active

container-runtime security security cloud-computing self-hosted runc rootless-containers user-namespace docker-in-docker systemd-in-containers kubernetes-in-docker container-isolation virtualization containers devops linux docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nestybox/sysbox")