Sandbox service built on Linux container technologies with simple REST and gRPC API

Ubuntu 24.04 XFCE desktop container — systemd PID 1, VNC + xrdp + SSH, optional NoMachine NX and NVIDIA GPU. Multi-Python (3.10/3.11/3.12/3.13), Firefox, VS Code, OBS, VLC. Non-privileged on cgroup v2.

Per-process network shaping and bandwidth control for Linux

A Linux container runtime built from scratch in C++20 — namespaces, OverlayFS, cgroup v2, and dual-stack networking without Docker or any container framework.

A tiny utility/example for freezing and unfreezing sober.

pmdaemon service

A small eBPF-based sandboxing tool designed to block any attempt by a process or its descendants to escalate to root with setuid() / setreuid() / setresuid().

Sandbox service built on Linux container technologies with simple REST and gRPC API.

Lightweight Prometheus exporter for Docker container metrics — built for ARM64 and cgroup v2

Per-process Linux network gate — Little Snitch for Linux, built on Rust + Aya eBPF. Watch outbound connections, allow/deny per process, throttle per-PID bandwidth via tc-bpf.

Kotlin async child-process management for tokio: whole-tree kill-on-drop (no orphans), plus streaming, pipelines, timeouts, and supervision library.

Lightweight Prometheus exporter for Docker container metrics, memory, CPU, network, disk I/O, and container state, without the overhead of cAdvisor.

Go library for configuring cgroup v2

Java agent to patch Gradle 8.x with cgroup v2 support for better memory detection in containers

Read-only MCP server exposing Linux cgroup v2 state (resource accounting, PSI, OOM events) as structured tools for AI agents.

Manages Linux cgroup configuration across Debian/Ubuntu and RedHat/AlmaLinux/Rocky/Fedora. Ensures persistent kernel parameters via GRUB updates and reboots when changes are applied.

A lightweight Linux process supervisor using modern cgroup v2 semantics.

A Prometheus-compatible metrics exporter that monitors container resource usage of Kubernetes workloads.

C/Linux 操作系统机制模型、Linux /proc 观测模块与 TraceBench 资源压力采样工具，用于可复现的 OS 行为分析。