Tools

ricccrd/dd

JIT-based userspace Linux kernel that runs containers natively on Apple Silicon macOS without a VM. Drop-in Docker Engine API replacement with…

smol-machines/smolvm

Portable, lightweight, self-contained virtual machine.

google/gvisor

Sandboxes containers via a userspace application kernel that intercepts system calls, limits host kernel access, and integrates with…

microsoft/litebox

A security-focused library OS supporting kernel- and user-mode execution

qubesos/qubes-core-admin

Manages the core lifecycle of Qubes OS domains via a Python admin API, handling secure compartmentalization with Xen and exposing an event system for…

anthropic-experimental/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

microsoft/igvm

Rust library and format specification for creating and loading Independent Guest Virtual Machine (IGVM) files, supporting hardware-isolated VMs with…

lxc/incus-os

Immutable Linux OS image optimized for running Incus containers and virtual machines, with UEFI Secure Boot, TPM 2.0 disk encryption, and automated…

kata-containers/kata-containers

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel…

dockur/windows

Run Windows inside a Docker container with KVM acceleration, automatic installation, and customizable resources. Supports multiple Windows versions,…

usbarmory/tamago

Framework for compiling and executing Go applications on bare metal processors, enabling secure firmware development with reduced attack surface…

nestybox/sysbox

An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.

patriksimek/vm2

Isolated JavaScript sandbox for Node.js that runs untrusted code with restricted access to built-in modules and host resources via Proxy-based…

usbarmory/gotee-example

GoTEE - example application

microsoft/secureboot_objects

Microsoft's curated repository of secure boot objects (KeK, Db, Dbx) for firmware and runtime, enabling transparent revocation updates and…

qemu/qemu

Official QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are disabled. Please only use…

firecracker-microvm/firecracker

Secure and fast microVMs for serverless computing.

flatpak/flatpak

Linux application sandboxing and distribution framework