Sysbox

<p align="center"> <img alt="sysbox" src="./docs/figures/sysbox-ce-header.png"/> </p> <p align="center"> <a href="https://github.com/nestybox/sysbox/blob/master/LICENSE"><img alt="GitHub license" src="https://img.shields.io/github/license/nestybox/sysbox"></a> <a href="https://travis-ci.com/nestybox/sysbox"> <img src="https://img.shields.io/circleci/project/github/badges/shields/master" alt="build status"></a> <a href="https://nestybox-support.slack.com/join/shared_invite/enQtOTA0NDQwMTkzMjg2LTAxNGJjYTU2ZmJkYTZjNDMwNmM4Y2YxNzZiZGJlZDM4OTc1NGUzZDFiNTM4NzM1ZTA2NDE3NzQ1ODg1YzhmNDQ#"> <img src="https://img.shields.io/badge/chat-on%20slack-FF3386"></a> </p>

Introduction

Sysbox is an open-source and free container runtime (a specialized "runc"), originally developed by Nestybox ([acquired by Docker][docker-acquisition] on 05/2022), that enhances containers in two key ways:

• Improves container isolation:

  • Linux user-namespace on all containers (i.e., root user in the container has zero privileges on the host).

  • Virtualizes portions of procfs & sysfs inside the container.

  • Hides host info inside the container.

  • Locks the container's initial mounts, and more.

• Enables containers to run same workloads as VMs:

  • With Sysbox, containers can run system-level software such as systemd, Docker, Kubernetes, K3s, buildx (including multi-arch builds), legacy apps, multi-arch apps, and more seamlessly & securely.

  • This software can run inside Sysbox containers without modification and without using special versions of the software (e.g., rootless variants).

  • No privileged containers, no complex images, no tricky entrypoints, no special volume mounts, etc.

Think of it as a "container supercharger": it enables your existing container managers / orchestrators (e.g., Docker, Kubernetes, etc.) to deploy containers that have hardened isolation and can run almost any workload that runs in VMs.

Sysbox does this by making the container resemble a VM-like environment as much as possible, using advanced OS virtualization techniques.

Unlike alternative runtimes such as Kata and KubeVirt, it does not use VMs. This makes it easier to use (particularly in cloud environments by avoiding nested virtualization), although it does not provide the level of isolation that VM-based runtimes do. See here for a comparison.

There is no need to learn new tools or modify your existing container images or workflows to take advantage of Sysbox. Simply install it and point your container manager / orchestrator to it to deploy enhanced containers.

Sysbox can live side-by-side with other container runtimes on the same host (e.g., the default OCI runc, Kata, etc.) You can easily choose which containers or pods to run with each, depending on your needs.

Demo Videos

• "VM-like" containers with Docker + Sysbox

• Rootless Kubernetes pods with Sysbox

Contents

• License
• Relationship to Nestybox & Docker
• Motivation
• How it Works
• Comparison to Related Technologies
• Audience
• Sysbox Enterprise Edition
• Sysbox Features
• System Containers
• Installation
• Using Sysbox
• Documentation
• Performance
• Under the Covers
• Contributing
• Security
• Troubleshooting & Support
• Uninstallation
• Roadmap
• Contact
• Thank You

License

Sysbox is free and open-source, licensed under the Apache License, Version 2.0. See the LICENSE file for details.

Relationship to Nestybox & Docker

Sysbox was originally developed by Nestybox. As [Nestybox is now part of Docker][docker-acquisition], Docker is the main sponsor of the Sysbox project.

Having said this, Sysbox is a community open-source project and it's not officially supported by Docker (i.e., Docker subscriptions do not include Sysbox support). Support is provided on a best effort basis via this Github repo or via the [Sysbox Slack Workspace][slack].

We encourage participation from the community to help evolve and improve Sysbox, with the goal of increasing the use cases and benefits it enables. External maintainers and contributors are welcomed.

Motivation

Sysbox solves problems such as:

• Enhancing the isolation of containerized microservices (root in the container maps to an unprivileged user on the host).

• Enabling a highly capable root user inside the container without compromising host security.

• Securing CI/CD pipelines by enabling Docker-in-Docker (DinD) or Kubernetes-in-Docker (KinD) without insecure privileged containers or host Docker socket mounts.

• Enabling the use of containers as "VM-like" environments for development, local testing, learning, etc., with strong isolation and the ability to run systemd, Docker, IDEs, and more inside the container.

• Running legacy apps inside containers (instead of less efficient VMs).

• Replacing VMs with an easier, faster, more efficient, and more portable container-based alternative, one that can be deployed across cloud environments easily.

• Partitioning bare-metal hosts into multiple isolated compute environments with 2X the density of VMs (i.e., deploy twice as many VM-like containers as VMs on the same hardware at the same performance).

• Partitioning cloud instances (e.g., EC2, GCP, etc.) into multiple isolated compute environments without resorting to expensive nested virtualization.

How it Works

<p align="center"> <img alt="sysbox" src="./docs/figures/sysbox-diagram.png"/> </p>

Sysbox installs easily on Linux hosts (bare-metal, VM, on-prem, cloud, etc.). It works on all major cloud-based IaaS and Kubernetes services (e.g., EC2, GCP, GKE, EKS, AKS, Rancher, etc.)

Once installed, Sysbox works under the covers: you use Docker, Kubernetes, etc. to deploy containers with it.

For example, this simple Docker command creates a container with Sysbox:

$ docker run --runtime=sysbox-runc -it any_image

You get a well isolated container capable of seamlessly running microservices as well as system-level software that normally that runs on VMs (e.g., systemd, Docker, Kubernetes, etc).

More on how to use Sysbox here.

Comparison to Related Technologies

<p align="center"> <img alt="sysbox" src="./docs/figures/sysbox-comparison.png"/> </p>

As shown, Sysbox enables unprivileged containers to run system-level workloads such as systemd, Docker, Kubernetes, etc., seamlessly, while giving you a balanced approach between container isolation, performance, efficiency, and portability.

And it does this with minimal configuration changes to your existing infra: just install Sysbox and configure your container manager/orchestrator to launch containers with it, using the image of your choice.

Note that while Sysbox hardens the isolation of standard containers and voids the need for insecure privileged containers in many scenarios, it does not (yet) provide the same level of isolation as VM-based alternatives or user-space OSes like gVisor. Therefore, for scenarios where the highest level of isolation is required, alternatives such as KubeVirt may be preferable (at the expense of lower performance and efficiency and higher complexity and cost).

See this blog post for more.

Audience

The Sysbox project is intended for anyone looking to experiment, invent, learn, and build systems using system containers. It's cutting-edge OS virtualization, and contributions are welcomed.

Sysbox Enterprise Edition [DEPRECATED]

Prior to the [acquisition by Docker][docker-acquisition] on 05/2022, Nestybox offered [Sysbox Enterprise][sysbox-ee-repo] as an enhanced version of Sysbox (e.g., more security, more workloads, and official support).

After the acquisition however, Sysbox Enterprise is no longer offered as a standalone product but has instead been incorporated into Docker Desktop (see Docker Hardened Desktop).

NOTE: As Sysbox Enterprise is no longer offered as a standalone product, Docker plans to make some Sysbox Enterprise features available in Sysbox Community Edition. The features are TBD and your feedback on this is welcome.

Sysbox Features

The table below summarizes the key features of the Sysbox container runtime.

It also provides a comparison between the Sysbox Community Edition (i.e., this repo) and the previously available Sysbox Enterprise Edition (now deprecated).

<p align="center"> <img alt="sysbox" src="./docs/figures/sysbox-features.png" width="1000" /> </p>

More on the Sysbox features here.

If you have questions, you can reach us here.

System Containers

We call the containers deployed by Sysbox system containers, to highlight the fact that they can run not just micro-services (as regular containers do), but also system software such as Docker, Kubernetes, Systemd, inner containers, etc.

More on system containers here.

Installation

Host Requirements

The Sysbox host must meet the following requirements:

• It must be running o