Enroot

What Enroot is

Enroot is a free Linux command-line utility that turns container and operating system images into unprivileged sandboxes. The project describes it for high-performance computing and virtualized environments where portability and reproducibility matter, but extra isolation is not required. Enroot runs without a daemon and supports multi-user use without a setuid binary. It uses Linux user and mount namespaces to keep filesystems separate, while providing little to no isolation. Its commands cover importing, creating, starting, executing in, exporting, listing, bundling, and removing sandboxes. It can import known container image formats, including Docker images; the README reports a 3x to 5x speedup for importing large Docker images. Built-in GPU support uses libnvidia-container, and hooks can provide NVIDIA GPU support or inject Mellanox host MOFED for InfiniBand HCA support. Runtime settings can be set in enroot.conf or through environment variables, which take precedence. Standard and hardened package flavors are available; the hardened option is described as slightly more secure but having greater overhead. Enroot is released under the Apache License 2.0 and requires Linux kernel 3.10 or later with support for namespaces and seccomp filters.