Nucleus - A high-performance, minimalist container engine written in Rust

[high herald]

I was always fascinated by how Linux works internally, and then Docker internals. Nucleus is minimalism at its core, which does not try to copy all of Docker but gives you the same kind of feel at much lesser complexity.

It serves as a robust demonstration of modern Linux containerization, utilizing kernel primitives like namespaces, Cgroups v2, OverlayFS, and pivot_root for secure and isolated process execution.

Currently, there are two branches: main, which is complete, and enhancements. The difference is that the enhanced version has more added capabilities. I need folks to provide feedback so I can continue enhancing.

Feedback appreciated.

https://github.com/sumant1122/Nucleus

[crystal spear]

After a fork() in a multithreaded program, the child can safely call only async-signal-safe functions (see signal-safety(7)) until such time as it calls execve(2)

[crystal spear]

even ignoring the footguns around fork, the unsafe blocks are entirely undocumented, and the error handling is filled with unwrap()s and .ok();
this is unacceptable for any application that claims to seriously care about security

as well as the functions are absolutely huge and messy

[still arch]

It was gen by AI

[crystal spear]

if that's so it needs the AI Assisted tag

[high herald]

Thank you for the feedback.
Added the AI assisted tag and all the runtime .unwrap() calls have been replaced with safer error handling.

[crystal spear]

thanks for adding the tag. Can you verify if any other of your showcase posts are missing the tag currently?