Nucleus
Containers & OrchestrationA minimalist, declarative container runtime for Linux that provides ultra‑lightweight, security‑hardened isolation using Nix and kernel primitives
Features
- Extremely low cold‑start overhead (≈12 ms) compared with Docker (~500 ms)
- Declarative production deployment via NixOS module, TOML config, and reproducible Nix closures
- Zero‑overhead isolation using cgroups, namespaces, seccomp, Landlock and optional gVisor kernel
- Supports both ephemeral agent sandboxes and full‑featured networked services with health checks and systemd integration
- Rich policy controls: per‑service seccomp JSON allowlists, capability TOML policies, Landlock rules with SHA‑256 pinning
Recent releases
View all 6 releases →No releases yet
We'll surface new releases as they're published — check back soon.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Install & Platforms
Platforms
linux
Alternative to
Docker