Fresh OCI boxes for tool calls, notebook cells, and CI steps is the clearest way to explain this. Network-off by default, dropped capabilities, and typed faults beside stdout are concrete details. I'd move the limits and non-goals closer to the top.
kern
A fast, rootless sandbox and virtual resource runtime for running workloads in real containers.
1 ratings3.90
Saves70
CategoryDeveloper Tools
PlatformWeb
PricingFree
Screenshots haven’t been added yet. Visit the product to take a look.
kern is a lightweight container runtime that provides rootless, kernel-enforced sandboxing and resource management in a single static binary without a daemon. It supports running any workload in real OCI containers, including AI-generated code and agent tool-calls, with secure defaults like network isolation, seccomp allowlists, and resource caps. Kern also offers SDK bindings for Python and Node.js, and can run entire stacks from Docker Compose files unmodified.
Ratings & Reviews
Write a reviewInformation
CategoryDeveloper Tools
PlatformsWeb
PricingFree
AccountNot confirmed
ListedAugust 2026
WebVisit
Report a problem
Around the Web
Show HN70 source points · 9 comments
It looks cool and I am building it r.n. but the submission title was a little misleading as it says "container ... runtime" right there, and I guess it is, but it is not a CRI implementation.
jeffbee · Imported from Show HN
Congrats on the launch! What is the typical cold-start time from zero to running an un-cached single-step Python/Bash command inside an isolated rootfs?
sdageltc · Imported from Show HN