kern is a lightweight, daemonless container runtime that provides kernel-enforced isolation for workloads, including untrusted or AI-generated code, using a single 1.52 MB static binary.

Key Points

• Executes OCI-compliant containers with cold start times of approximately 3.5 milliseconds.
• Operates as a rootless, daemon-free runtime requiring only a Linux kernel with cgroup v2 and unprivileged user namespaces.
• Supports Docker Compose files and OCI images without requiring a background service or complex daemon stack.
• Includes resource profiling for CPU, memory, and device access, configurable via a simple TOML file.
• Offers language bindings for Python and Node.js, enabling developers to embed secure, isolated sandboxes directly into applications.
• Compatible with Linux, WSL2, and ARM-based hardware like Raspberry Pi and Jetson boards.

Why it Matters

By eliminating the overhead of a persistent daemon, kern significantly reduces resource consumption and startup latency for isolated execution environments. This makes it a highly efficient solution for developers needing to run untrusted code, CI jobs, or AI-generated tasks securely without the complexity of traditional container engines.