user-namespaces 开源项目推荐（25 个）

containers /bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

projectatomic /bwrap-oci

该项目在 GitHub 上没有填写描述

stemjail /stemjail

StemJail: Dynamic Role Compartmentalization

Project-Colony /Raven

Run Windows programs against a real Windows installation mounted as C: - Wine keeps the syscall boundary, Microsoft provides the world

basnijholt /zfs-tenant

Give a friend a quota-capped corner of your ZFS pool for raw encrypted backups, without giving them a shell

lure-sh /fakeroot

A pure-Go implementation of fakeroot using Linux user namespaces.

DarkCaster /Sandboxer

Simple desktop application sandboxing tool for GNU\Linux

ad-freiburg /docker-no-trivial-root

Very experimental docker authorization plugin, disabling some trivial ways of gaining root via docker

b2ag /unshare-fun

Experiments with unshare

dgl /sftp-ssh-limit

Limit SFTP access to a remote (Linux) system

kinvolk-archives /fuse-userns-patches

Kernel patches for non-init user namespace on FUSE filesystem

gabyx /container-nesting

Nesting containers with podman

yamixst /installctl

Run untrusted third-party installers (curl | sh) in an unprivileged FUSE copy-on-write sandbox and review changes before applying them

alcortesm /isolate

Runs commands in Linux containers with configurable levels of isolation.

kinvolk /nfs-mount-in-userns

Experiment with NFS mount in a user namespace

GuilloteauQ /nix-shell-container

A nix shell running in a (thin) container

gairxx /vroot

Instant, isolated, single-file Linux root-shell sandboxes built from a flag. A lightweight Docker/proot/chroot alternative with no daemon and no sudo.

2824799 /droidspaces-xiaomi-17-kernel

Droidspaces container kernel patches and flashable boot images for Xiaomi 17 (pudding, SM8850) on Android 17 / HyperOS 4.0.0.9-4.0.0.26 with the Android Common Kernel 6.12 GKI baseline

jronminh /sudo-less

Real apt + dpkg that install Debian packages into ~/.local without root, built only on what Debian ships: user and mount namespaces, unprivileged overlayfs and systemd's user manager. Services run as sandboxed user units. Plain bash, no containers or helpers.

git-bruh /dotfiles

Dots