“Nestybox enables our customers to deploy VM workloads in containers, securely and without the deployment complexity.”
- Kyle Carberry, CTO @ Coder
Containers beyond Microservices
Nestybox empowers containers to act as virtual servers capable of running
workloads such as Systemd, Docker, Kubernetes, and even legacy apps, seamlessly & securely.
This way you can use containers to package & deploy not just apps, but full OS environments.
Currently this requires insecure privileged containers plus complicated container images with tricky entrypoints and lot's of custom volume mounts.
No more. Nestybox enables you to do this using:
Simple Docker or Kubernetes commands
Simple Container images
Strongly Isolated Containers
No Hardware Virtualization (VMs)
Sysbox: a next gen "runc"
Sysbox is an open-source, next generation container runtime developed by Nestybox.
It works below Docker and Kubernetes.
With Sysbox, containers are always rootless (for security) and can seamlessly run most workloads that run in VMs, including systemd, Docker, and even Kubernetes.
This is all you need to deploy an enhanced container with Sysbox:
It's often useful to run Docker inside a container for development, testing, and CI/CD.
Up to now, the only way to do this was to use very insecure privileged containers or exposing the host's Docker socket into a container. Both are risky, allowing containers to breach the host.
Nestybox removes these limitations, enabling you to run Docker inside a rootless container, with total isolation from the host and without the limitations of rootless Docker.
You can even preload inner container images into the outer container using a Dockerfile or Docker commit.
Running Kubernetes clusters inside containers is very useful for development, testing, and CI/CD.
It avoids the need for heavy VMs or costly and less flexible cloud-based clusters.
There exist a few tools to run Kubernetes-in-Docker. However these use complex container images and very insecure privileged containers.
Nestybox solves this, enabling you to deploy the cluster in containers, using strong isolation and very simple container images that you fully control.
You can deploy a 10-node K8s cluster on a laptop, in less than 2 minutes and with only 1 GB storage overhead!
Rootless containers offer enhanced security, as the root user inside the container has no privileges on the underlying host.
With Nestybox, you can use rootless containers seamlessly and without the complexity and limitations of alternatives such as rootless Docker.
A simple "docker run --runtime=sysbox-runc" command creates a rootless container capable of running any micro-service as well as most workloads that run in VMs, seamlessly.
With Nestybox, you can deploy secure "VM-like" containers, capable of running most workloads that run in VMs (e.g., systemd, full root user, several services, etc.)
This enables running full dev environments or legacy apps inside well isolated containers.
For legacy apps, it enables them to operate within cloud-native frameworks without the need to re-architect them or deploy them in less efficient and less portable VMs.
You can deploy 2x as many containers as VMs on a given machine, yielding cost savings of up to 50%!
Sysbox integrates with Docker and Kubernetes, so you deploy containers as usual (no need to learn new tools).
The key difference is that you get a more secure and powerful container, capable of seamlessly running most workloads that run in VMs.
Sysbox is rootless containers, without limitations.
The containers deployed by Sysbox are strongly secured via the Linux User Namespace. You get full root in the container but no privileges on the host.
Provision "VM-like" containers 10x as fast as VMs.
And unlike VMs which are tied to a specific hypervisor or cloud provider, containers deployed with Sysbox run wherever Linux runs. Thus you can easily provision them across clouds or devices in seconds.
Deploy 2x as many "VM-like" containers as VMs on a server and get the same performance. This essentially reduces your hardware cost by 50%! See this blog article for more on this.
WHAT PEOPLE SAY
You guys are doing such great work by filling in a huge security gap that has been missing for so long. With Sysbox our CI/CD is so secure that pen testers are not able to exploit it in any way.
Sr. Data Engineer
Nestybox Rocks! ... Sysbox provide me with a very simple and easy to use solution to my problem (after all other "solutions" I had found on the web failed).