Open Source C Container Management Software

gVisor is an application kernel developed by Google that provides a strong layer of isolation between applications and the host operating system. Written in Go, it implements a Linux-compatible system call interface that runs entirely in user space, creating a secure sandboxed environment for containers. Unlike traditional virtual machines or lightweight syscall filters, gVisor follows a third approach that offers many of the security benefits of virtualization while maintaining the speed, resource efficiency, and flexibility of containers. Its key runtime, runsc, integrates seamlessly with container ecosystems such as Docker and Kubernetes, making it easy to deploy sandboxed workloads using familiar tools. By intercepting and safely handling syscalls from applications, gVisor reduces the attack surface of the host kernel, mitigating risks associated with running untrusted or potentially malicious code in containerized environments.

A fast and low-memory footprint OCI Container Runtime fully written in C. While most of the tools used in the Linux containers ecosystem are written in Go, I believe C is a better fit for a lower-level tool like container runtime. runc, the most used implementation of the OCI runtime specs written in Go, re-execs itself and uses a module written in C for setting up the environment before the container process starts. crun aims to be also usable as a library that can be easily included in programs without requiring an external process for managing OCI containers.

Kepler (Kubernetes-based Efficient Power Level Exporter) uses eBPF to probe performance counters and other system stats, use ML models to estimate workload energy consumption based on these stats, and exports them as Prometheus metrics.

barco is a project I worked on to learn more about Linux containers and the Linux kernel, based on other guides on the internet. Linux containers are made up by a set of Linux kernel features. namespaces: are used to group kernel objects into different sets that can be accessed by specific process trees. There are different types of namespaces, for example,the PID namespace is used to isolate the process tree, while the network namespace is used to isolate the network stack.