KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #developer-tools #ai-agent #claude-code #codex #typescript #ai-agents #deepseek-harness #mcp #cli #rust

b0nkers

★ 28 Open GitHub ↗

b0nker lightweight containerization

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## Overview

b0nker is a minimal container runtime written in Rust. It implements the core mechanisms containers are built on directly without a daemon, an image format, or an OCI runtime layer. 
Given a command, it creates a set of Linux namespaces, applies cgroup resource limits, constructs an isolated root filesystem using an overlay mount and pivot_root, and executes the command inside that environment.

## How it works

b0nker relies on four Linux mechanisms, each responsible for a specific type of isolation.

Namespaces, created with `clone` and `unshare`, control what the process can see: other processes, mount points, and hostname.
pivot_root gives the process its own root filesystem safely, avoiding the escape issues associated with chroot. 
cgroups v2 limit how much memory and how many processes the container can use. 
Overlayfs allows the root filesystem to be shared across containers without modifying the underlying base image.

A full breakdown of these mechanisms, including the underlying syscalls, is available in the accompanying [blog post](https://op3kay.dev/writing/b0nker)

## Usage

```bash
sudo -E cargo build --release
sudo -E ./target/release/b0nker run <command> [args...]
```

Example:

```bash
$ sudo -E ./target/release/b0nker run ps
PID   USER     TIME  COMMAND
    1 0         0:00 ps
```

Inside the container, the process sees itself as PID 1, with no visibility into host processes or the host filesystem.

## Benchmarks

100 runs of `b0nker run true`:

```
mean:    37.0 ms
median:  36.3 ms
min:     27.2 ms
max:     57.6 ms
```
## License

Licensed under the MIT License. See [LICENSE](./LICENSE) for details.

b0nkers

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README