Sysbox
Sysbox is an open-source container runtime that enhances container isolation and enables containers to run system-level workloads like systemd, Docker, and Kubernetes without privileged mode. It solves the problem of running VM-like workloads in containers securely and efficiently, targeting developers and operators using Docker or Kubernetes.
✨ Key features
- Enforces Linux user-namespace on all containers for better isolation.
- Virtualizes procfs and sysfs, hiding host info from containers.
- Runs systemd, Docker, Kubernetes, and legacy apps inside containers.
- No privileged containers or special images required.
- Works with Docker and Kubernetes without modifying workflows.
- Side-by-side with other runtimes like runc and Kata.
🎯 Use cases
- Running Docker-in-Docker (DinD) securely in CI/CD pipelines.
- Deploying Kubernetes-in-Docker (KinD) without privileged containers.
- Creating VM-like development environments with systemd and Docker.
- Running legacy applications in containers instead of VMs.
- Partitioning bare-metal hosts into isolated compute environments.
📦 Installation
🧰 Requirements: Linux host with supported distro and architecture (e.g., amd64, arm64); minimum 4 CPUs and 4GB RAM recommended.
Installation depends on environment:
- On Kubernetes: use the sysbox-deploy-k8s daemonset.
- Otherwise: use the Sysbox package for your distro.
- Or build from source.
See the docs for details: install-k8s, install-package, build from source.
🚀 Usage
$ docker run --runtime=sysbox-runc --rm -it --hostname my_cont registry.nestybox.com/nestybox/ubuntu-bionic-systemd-docker
root@my_cont:/#
⚠️ Good to know
Sysbox does not provide the same level of isolation as VM-based runtimes or gVisor; it is not officially supported by Docker and support is best-effort.
❓ FAQ
What is Sysbox?
Sysbox is an open-source container runtime that enhances isolation and enables containers to run system-level workloads like systemd and Docker.
How do I use Sysbox with Docker?
Install Sysbox and run containers with the --runtime=sysbox-runc flag, e.g., docker run --runtime=sysbox-runc -it any_image.
Does Sysbox require privileged containers?
No, Sysbox allows running system-level software without privileged containers or special images.
Can I use Sysbox with Kubernetes?
Yes, Sysbox can be installed on Kubernetes clusters using the sysbox-deploy-k8s daemonset and used via a runtimeClassName.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.