Show HN: Kern – container and resource runtime in a 1.5 MB binary, no daemon
Kern is a new, lightweight container runtime that provides kernel-enforced isolation in a 1.5 MB binary without requiring a daemon. It is designed for running untrusted or AI-generated code by leveraging Linux user namespaces.
Why it matters
It offers a highly efficient, low-overhead alternative to traditional container runtimes like Docker, specifically optimized for sandboxing AI agents.
kern: A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code.
A real, kernel-enforced container in ~3.5 ms, out of one 1.52 MB binary with no daemon.
0 RAM at rest · no daemon, no socket, nothing to start · one static binary, libc its only Rust dependency
# install the release binary (static, 1.52 MB, checksum-verified by the script) curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh # a throwaway shell in a real OCI image: rootless, kernel-enforced, a few ms kern box dev --image alpine -it -- sh No native Windows: use WSL2. Install .
One binary that manages resources, of which isolation is the first. That is why there is no single row for kern in a comparison table: it is a container runtime, a sandbox, a resource slicer and a stack runner at once, in 1.52 MB with no daemon.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in