kern

Kata Containers is an open-source container runtime and project that runs workloads inside lightweight virtual machines, combining a container-like interface with the workload isolation and security properties of virtual machines. Its core runtime integrates with container managers through a containerd shim v2 implementation; an agent inside each virtual machine or pod sets up the container environment, while a hypervisor provides the virtualized boundary. The project supports multiple virtualization technologies and architectures, uses a configuration file covering the runtime, agent, and hypervisor, and includes a host-capability check through the `kata-runtime check` command. The code is licensed under Apache 2.0.

Kernel is open-source browser infrastructure for AI agents and web automations. It provides sandboxed Chromium browsers that agents can use to act on websites, with fast startup, autoscaling, reusable sessions, managed authentication, proxy management, anti-bot and CAPTCHA handling, regional browsers, GPU acceleration, and live session observability with MP4 recording. Its configuration registry returns browser and proxy settings for a given URL, including success rates, sample sizes, and verification dates, so agents can select configurations that have been tested against bot checks. Kernel also provides browser telemetry for debugging agent errors and supports agentic payments through wallet integrations.

Microsandbox is a local-first microVM runtime and library for running untrusted workloads, including AI-agent tasks, user code, plugins, CI jobs, development environments, scrapers, and automation. It uses hardware-level isolation and runs standard OCI container images from registries such as Docker Hub and GHCR, with Docker-like image, command, shell, and volume workflows. The project provides SDKs for TypeScript, Rust, Python, Go, and Ruby, along with a CLI for booting and controlling sandboxes. Applications can create microVMs as child processes without a setup server or long-running daemon; sandboxes can also run detached for long-lived sessions. Agent Skills and an MCP server support agent-created sandboxes, and the project documents secret handling intended to keep keys out of the VM. It runs on Linux, macOS, and Windows, with platform-specific virtualization requirements, and is described as beta software.

KubeArmor is a runtime security and protection tool for Kubernetes environments that uses Linux security modules to enforce runtime policies and prevent malicious or disallowed commands from executing. Its prevention mode blocks commands at execution time rather than merely alerting afterward; in the demonstrated example, an attempted `ls` command fails.

Talos Linux is a modern, minimal Linux distribution built for running Kubernetes. Developed and supported by Sidero Labs, it is immutable and hardened, with all system management performed through an API rather than a shell or interactive console. API access uses mutual TLS authentication, while immutable infrastructure and atomic updates are intended to reduce configuration drift and support predictable Kubernetes and Linux updates. The project is fully open source and production-ready.