realexweb

I created this tool because I kept running code that an LLM just wrote in my home folder. That felt risky. Every time you run a command it happens in its container. The container runs without network access by default. It's rootless. Once the command finishes the container gets deleted. It cleans up after itself.

It uses Linux namespaces, cgroups and seccomp. Not a microVM. It is lightweight and fast.

smolvm is a microVM .kern is plain OS-level isolation

thanks.. let me know how it goes or if you hit any issues

Fair, and it's not CRI. The README's limits section says "Not a Kubernetes runtime. No CRI. Use containerd or CRI-O." I meant runtime in the docker/podman sense, pull and build and lifecycle in one binary, and you're right that the word is overloaded enough that the title doesn't carry that by itself.

Since you're building it, two things you'll hit before you hit the docs. cargo install needs the package name, because it searches the whole repo and finds three packages with binaries (the CLI, the fuzz harness, the Windows shim):

cargo install --git https://github.com/getkern/kern getkern --locked

And a source build is 1.91 MB, not the 1.5 in the title. The release binary is smaller because CI builds it with a pinned nightly, build-std and optimize_for_size, on an opt-level="z" profile; the source stays plain stable Rust on purpose, so building doesn't need nightly.

Interested in what breaks.

link