Sysbox
containeroci-runtimeopen sourceA container runtime giving user-namespace isolation and Docker-in-Docker without --privileged, hardened, still shared-kernel.
Sysbox is an OCI runtime that runs containers with automatic user-namespace isolation and lets them run system workloads (systemd, Docker-in-Docker) without --privileged, so a container root is not host root. That is meaningful hardening over stock runc. It remains a shared-kernel boundary, a kernel LPE still escapes it, which is the key caveat when it is marketed as a strong sandbox. Note that vendors sometimes claim Sysbox where a measurement finds stock runc, see the Daytona entry.
Strengths
- Automatic user-namespace isolation, container root is not host root
- Docker-in-Docker and systemd without --privileged
- Drop-in OCI runtime, low-to-moderate overhead
Limitations
- Shared kernel, a hardened container, not a hardware boundary
- Marketed as a strong sandbox but a kernel LPE still escapes it
- Linux only
Files & editor
desktop-mountBind-mount your project; the host editor edits it directly.
How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.