GoKawiilKern launches as a 1.5 MB daemonless container runtime for untrusted code
Kern is a new open-source tool that runs rootless, kernel-enforced containers from a single 1.52 MB static binary, with no background daemon or socket required. It can pull and build OCI images, launch a sandboxed shell in about 3.5 milliseconds, and apply CPU, memory, disk and device limits either inside a sandbox or directly to processes on the host via named resource profiles set in a kern.toml file.
GoKawiil's interpretation of the reporting above, not reported fact.
Most container tooling like Docker or containerd relies on a persistent daemon and heavier footprint, which adds attack surface and startup latency that matter when running untrusted or AI-generated code at scale. A tiny, daemonless binary with built-in seccomp, namespace isolation and cgroup limits could simplify securely executing arbitrary code in CI pipelines, serverless functions, or AI agent sandboxes without the operational overhead of a full container platform.
- Kern runs as a single 1.52 MB static Rust binary with no daemon, socket, or persistent process.
- It combines OCI container support, rootless sandboxing, and host-level resource limiting in one tool.
- A hardened sandbox with namespaces, seccomp, and cgroup v2 limits can be enabled with a single flag for untrusted code.
Rust for Rustaceans" by Jon Gjengset — Kern packs a whole container runtime into a 1.5 MB static Rust binary with libc as its only dependency — the kind of engineering this book is built to teach. It digs into idiomatic, low-level Rust: unsafe code, FFI, and building lean systems software. A great next step if the Show HN made you want to write your own tiny runtime.
See Rust for Rustaceans" by Jon Gjengset on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: github.com, 2026-08-24
Published there as: “Show HN: Kern – container and resource runtime in a 1.5 MB binary, no daemon”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.