A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.
-
Updated
Nov 10, 2026 - C++
GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — Build software better, together
#
linux-namespacesHere are 81 public repositories matching this topic...Language: All
Filter by language
Sort: Most stars
Sort options
Rootless container runtime with no daemon. Runs agent tool calls and LLM-generated code in kernel-enforced containers.
linux docker rust containers sandbox virtualization oci cgroups seccomp linux-namespaces code-execution overlayfs ai-agents container-runtime oci-runtime rootless podman daemonless code-interpreter docker-alternative
Jail-shell is a linux security tool mainly using chroot, namespaces technologies, limiting users to perform specific commands, and access sepcific directories.
Judging daemon for programming contests
Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.
linux rust security containers sandbox process sandboxing cgroups chroot seccomp linux-namespaces unshare rootless-containers landlock
Works with Linux namespaces througth glibc with pure python
Control plane for system processes
StemJail: Dynamic Role Compartmentalization
Multi-namespace Tailnet service. Run multiple Tailscale tailnets simultaneously on a single Linux machine.
linux networking namespaces linux-namespaces linux-networking tailscale tailscale-network tailscale-acl headscale tailnet hydrascale
An Erlang library for managing Unix processes
fork supervisor capsicum signal system-programming seccomp prctl exec linux-namespaces pledge procctl
Better agentic security inside a sandbox; one wrapper, any agent.
linux-namespaces bubblewrap bwrap ai-development-tools ai-terminal claude-code owasp-llm cli-agent ai-sandboxes ai-firewall terminal-agent grok-cli gpt-5-codex claude-code-agents ai-sandbox long-running-agents agentic-security agent-ide ai-agent-harness grok-build
Understand how linux containers works with practical examples
Joblet is a micro-container runtime for running Linux jobs with: Process and filesystem isolation (PID namespace, chroot) Fine-grained CPU, memory, and IO throttling (cgroups v2) Secure job execution with mTLS and RBAC Built-in scheduler, SSE log streaming, and multi-core pinning Ideal for: Agentic AI Workloads (Untrusted code)
linux golang system process-isolation cgroups namespaces resource-management linux-namespaces containerization system-call-isolation
Run opencode inside a bubblewrap sandbox — confine AI file access to your current working directory
sandbox opencode enhancer isolation linux-namespaces enhance bubblewrap bwrap agent-network ai-privacy filesystem-security secure-ai terminal-ai ai-assisted-coding ai-sandboxes agent-isolation agent-cli agentic-coding-tool agent-guardrails agent-ide
A lightweight process isolation tool, requiring absolutely no privileges to run
A GNU/Linux specific toolkit for making and managing jails which are OS level virtualization containers. Implemented using shell scripts with chroot, linux namespaces, pivot_root and embedded into busybox.
linux shell bash containers virtualization dash jails busybox chroot namespaces linux-namespaces busybox-ash pivot-root
Native macOS container runtime written in Rust using Apple Virtualization Framework, Linux namespaces, cgroups v2, and OverlayFS
macos rust containers virtualization oci linux-namespaces overlayfs container-runtime cgroups-v2 apple-silicon
Python library to control Linux kernel namespaces
Add this topic to your repoTo associate your repository with the linux-namespaces topic, visit your repo's landing page and select "manage topics." |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |