2
2
3
3
## Contents
4
4
5
- - [ About Nestybox] ( #about-nestybox )
6
- - [ About Sysbox] ( #about-sysbox )
7
- - [ Features] ( #features )
8
- - [ System Container Deployment] ( #system-container-deployment )
9
- - [ System Container Software] ( #system-container-software )
10
- - [ System Container Image Creation] ( #system-container-image-creation )
11
- - [ Security and Isolation] ( #security-and-isolation )
5
+ - [ Introduction] ( #introduction )
6
+ - [ Download] ( #download )
12
7
- [ Supported Linux Distros] ( #supported-linux-distros )
13
8
- [ Host Requirements] ( #host-requirements )
14
9
- [ Installation] ( #installation )
15
10
- [ Usage] ( #usage )
11
+ - [ Sysbox Features] ( #sysbox-features )
12
+ - [ System Container Deployment] ( #system-container-deployment )
13
+ - [ System Container Software] ( #system-container-software )
14
+ - [ System Container Image Creation] ( #system-container-image-creation )
15
+ - [ Security and Isolation] ( #security-and-isolation )
16
16
- [ Documentation] ( #documentation )
17
- - [ Software supported inside the System Container] ( #software-supported-inside-the-system-container )
18
17
- [ Integration with Container Managers] ( #integration-with-container-managers )
19
18
- [ Production Readiness] ( #production-readiness )
20
19
- [ Troubleshooting] ( #troubleshooting )
21
20
- [ Issues] ( #issues )
22
21
- [ Roadmap] ( #roadmap )
23
22
- [ We need your feedback] ( #we-need-your-feedback )
24
23
- [ Uninstallation] ( #uninstallation )
24
+ - [ About Nestybox] ( #about-nestybox )
25
25
- [ Contact] ( #contact )
26
26
- [ Thank You] ( #thank-you )
27
27
28
- ## About Nestybox
28
+ ## Introduction
29
29
30
- Nestybox expands the power of Linux containers.
30
+ Sysbox is a container runtime, developed by [ Nestybox] ( #about-nestybox ) , that installs on a Linux host and
31
+ integrates with Docker, enabling Docker to create ** system containers** .
31
32
32
- We are developing software that enables deployment of ** system containers**
33
- with Docker (and soon Kubernetes).
34
-
35
- A Nestybox system container is a Linux container designed to run low-level system
36
- software, not just applications. See this [ blog article] ( https://blog.nestybox.com/2019/09/13/system-containers.html ) for more info on system
37
- containers and some of the use cases we envision for them.
38
-
39
- Our mission is to make our system containers run as many system-level
40
- workload types as possible in order to provide users a fast,
41
- efficient, and easy-to-use alternative to virtual machines for
42
- deploying virtual hosts on Linux. And for this to work out-of-the-box
43
- and securely, without complex configurations and without resorting
44
- to unsecure privileged containers.
33
+ A Nestybox system container is a Linux container designed to run
34
+ low-level system software, not just applications. For example you can
35
+ run Docker and Systemd inside the system container, ** without resorting
36
+ to unsecure privileged containers or complex Docker configurations** .
45
37
46
- ## About Sysbox
47
-
48
- Sysbox is software that installs on a Linux host and integrates with Docker,
49
- enabling Docker to create system containers.
38
+ See this [ blog article] ( https://blog.nestybox.com/2019/09/13/system-containers.html )
39
+ for more info on system containers and some of the use cases we
40
+ envision for them.
50
41
51
42
Users do not normally interact with Sysbox directly. Instead, users
52
- create system containers with Docker as described below.
53
-
54
- ## Features
43
+ typically use Docker to create and deploy system containers.
55
44
56
- Below is a list of features currently supported by Sysbox .
45
+ Checkout this [ video ] ( https://asciinema.org/a/kkTmOxl8DhEZiM2fLZNFlYzbo?speed=1.75 ) to see how it works .
57
46
58
- ### System Container Deployment
47
+ The [ Sysbox Quickstart Guide] ( docs/quickstart.md ) and the [ Nestybox Blog Site] ( https://blog.nestybox.com ) have
48
+ many more examples.
59
49
60
- - Supports deployment of system containers with Docker.
50
+ ## Download
61
51
62
- - The system containers can run concurrently with regular Docker
63
- application containers, without conflict.
52
+ The latest release of Sysbox is [ here] ( https://github.com/nestybox/sysbox-external/releases ) .
64
53
65
- ### System Container Software
66
-
67
- - Supports running Docker inside the system container.
68
-
69
- - Cleanly & securely, with total isolation between the Docker inside
70
- the container and the Docker on the host. No need to use unsecure
71
- privileged containers or to bind-mount the host's Docker socket
72
- into the container.
73
-
74
- - The Docker inside the system container can build and run
75
- containers as usual.
76
-
77
- - This is useful for Docker sandboxing, testing and CI/CD use cases.
78
-
79
- - Supports running Systemd inside the system container (preliminary support).
80
-
81
- - Useful for system containers that are used as virtual hosts.
82
-
83
- - Run Systemd securely (without resorting to privileged Docker containers).
84
-
85
- - Super easy: simply launch a system container image with Systemd as
86
- its entry point and Sysbox will ensure the system container is setup
87
- to run Systemd without problems.
88
-
89
- ### System Container Image Creation
90
-
91
- - Use Docker to build system container images, just like regular containers.
92
-
93
- - In addition, Sysbox supports using ` docker build ` or ` docker commit ` to create
94
- system container images with pre-packaged inner containers in them.
95
-
96
- - This enables you to use the system container as a fully pre-configured
97
- Docker sandbox environment.
98
-
99
- - When you start the system container all inner Docker container images
100
- are ready to run. No need to pull the inner Docker images from a
101
- remote repository.
102
-
103
- ### Security and Isolation
104
-
105
- - Enhanced system container isolation
106
-
107
- - System containers use the Linux user namespace and exclusive
108
- user-ID and group-ID mappings for increased container-to-host and
109
- container-to-container isolation.
110
-
111
- - Resource isolation
112
-
113
- - Programs inside the system container (e.g., Docker) are limited
114
- to using the resources given to the system container itself.
115
-
116
- - Partially virtualized procfs
117
-
118
- - Processes inside the system container see a partially virtualized ` /proc ` .
119
-
120
- - This makes the system container more closely resemble a physical
121
- host or VM.
122
-
123
- - Prevents processes within the container from changing global
124
- kernel settings.
125
-
126
- Please see our [ Roadmap] ( #roadmap ) for a list of features we are working on.
54
+ Installation instructions are below.
127
55
128
56
## Supported Linux Distros
129
57
@@ -217,8 +145,8 @@ If you hit problems during installation, see the [Troubleshooting document](docs
217
145
218
146
## Usage
219
147
220
- To launch a system container with Docker, simply point Docker to the
221
- Sysbox container runtime as follows:
148
+ Once Sysbox is installed, you launch a system container with Docker by
149
+ simply pointing Docker to the Sysbox container runtime as follows:
222
150
223
151
``` console
224
152
$ docker run --runtime=sysbox-runc --rm -it --hostname my_cont debian:latest
@@ -233,6 +161,90 @@ It's perfectly fine to run system containers launched with Docker +
233
161
Sysbox along side regular Docker application containers; they won't
234
162
conflict.
235
163
164
+ The [ Sysbox Quickstart Guide] ( docs/quickstart.md ) and the [ Nestybox Blog Site] ( https://blog.nestybox.com ) have
165
+ more usage examples.
166
+
167
+ Also, this [ video] ( https://asciinema.org/a/kkTmOxl8DhEZiM2fLZNFlYzbo?speed=1.75 ) shows how it works.
168
+
169
+ ## Sysbox Features
170
+
171
+ Below is a list of features currently supported by Sysbox.
172
+
173
+ ### System Container Deployment
174
+
175
+ - Supports deployment of system containers with Docker.
176
+
177
+ - The system containers can run concurrently with regular Docker
178
+ application containers, without conflict.
179
+
180
+ ### System Container Software
181
+
182
+ - Supports running Docker inside the system container.
183
+
184
+ - Cleanly & securely, with total isolation between the Docker
185
+ inside the container and the Docker on the host. No need to
186
+ use unsecure privileged containers or to bind-mount the host's
187
+ Docker socket into the container.
188
+
189
+ - The Docker inside the system container can build and run
190
+ containers as usual.
191
+
192
+ - This is useful for Docker sandboxing, testing and CI/CD use
193
+ cases.
194
+
195
+ - Supports running Systemd inside the system container (preliminary support).
196
+
197
+ - Useful for system containers that are used as virtual hosts.
198
+
199
+ - Run Systemd securely (without resorting to privileged Docker
200
+ containers).
201
+
202
+ - Super easy: simply launch a system container image with
203
+ Systemd as its entry point and Sysbox will ensure the system
204
+ container is setup to run Systemd without problems.
205
+
206
+ - See [ here] ( docs/usage.md#running-software-inside-the-system-container )
207
+ for more info on this.
208
+
209
+ ### System Container Image Creation
210
+
211
+ - Use Docker to build system container images, just like regular containers.
212
+
213
+ - In addition, Sysbox supports using ` docker build ` or ` docker commit ` to create
214
+ system container images with pre-packaged inner containers in them.
215
+
216
+ - This enables you to use the system container as a fully pre-configured
217
+ Docker sandbox environment.
218
+
219
+ - When you start the system container all inner Docker container images
220
+ are ready to run. No need to pull the inner Docker images from a
221
+ remote repository.
222
+
223
+ ### Security and Isolation
224
+
225
+ - Enhanced system container isolation
226
+
227
+ - System containers use the Linux user namespace and exclusive
228
+ user-ID and group-ID mappings for increased container-to-host and
229
+ container-to-container isolation.
230
+
231
+ - Resource isolation
232
+
233
+ - Programs inside the system container (e.g., Docker) are limited
234
+ to using the resources given to the system container itself.
235
+
236
+ - Partially virtualized procfs
237
+
238
+ - Processes inside the system container see a partially virtualized ` /proc ` .
239
+
240
+ - This makes the system container more closely resemble a physical
241
+ host or VM.
242
+
243
+ - Prevents processes within the container from changing global
244
+ kernel settings.
245
+
246
+ Please see our [ Roadmap] ( #roadmap ) for a list of features we are working on.
247
+
236
248
## Documentation
237
249
238
250
We have several documents to help you use and get the best out of
@@ -266,33 +278,6 @@ system containers.
266
278
Also, the [ Nestybox blog site] ( https://blog.nestybox.com ) has articles
267
279
on how to use system containers.
268
280
269
- ## Software supported inside the System Container
270
-
271
- A system container is logically a super-set of a regular Docker
272
- application container, and thus should be able to run any application
273
- that runs in a regular Docker container. In addition, it runs
274
- system-level software that does not run in a regular Docker container.
275
-
276
- For system-level software, we currently support running the following
277
- inside the system container:
278
-
279
- - Systemd
280
-
281
- - Allows using the system container as a virtual host, much like you
282
- would use a VM.
283
-
284
- - Docker
285
-
286
- - Allows you to build and run Docker application containers inside
287
- the system container, just as you would on a physical host or in a
288
- VM.
289
-
290
- - Allows you to use the system container as a Docker sandbox, or in
291
- CI/CD pipelines where the need to deploy a container to build
292
- another container arises often.
293
-
294
- See [ here] ( docs/usage.md#running-software-inside-the-system-container ) for more info on this.
295
-
296
281
## Integration with Container Managers
297
282
298
283
Sysbox is designed to work with Docker / Containerd.
@@ -380,6 +365,20 @@ $ sudo dpkg --purge sysbox
380
365
$ sudo userdel sysbox
381
366
```
382
367
368
+ ## About Nestybox
369
+
370
+ [ Nestybox] ( https://www.nestybox.com ) expands the power of Linux containers.
371
+
372
+ We are developing software that enables deployment of ** system containers**
373
+ with Docker (and soon Kubernetes).
374
+
375
+ Our mission is to make our system containers run as many system-level
376
+ workload types as possible in order to provide users a fast,
377
+ efficient, and easy-to-use alternative to virtual machines for
378
+ deploying virtual hosts on Linux. And for this to work out-of-the-box
379
+ and securely, without complex configurations and without resorting to
380
+ unsecure privileged containers.
381
+
383
382
## Contact
384
383
385
384
Please contact us at
` [email protected] ` for any questions. We will
0 commit comments