google/nsjail

Linux namespaces and seccomp-bpf sandbox

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Application Kernel for Containers

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

Secure and fast microVMs for serverless computing.

Linux Runtime Security and Forensics using eBPF

A next-generation cloud native kernel designed to unlock best-in-class performance, security primitives and efficiency savings.

eBPF-based Security Observability and Runtime Enforcement

Hyperlight is a lightweight Virtual Machine Manager (VMM) designed to be embedded within applications. It enables safe execution of untrusted code within micro virtual machines with very low latency and minimal overhead.