getkern/kern

What it solves

kern is a fast, rootless sandbox and virtual resource runtime designed to run workloads in real containers with minimal overhead. It specifically addresses the need for high-performance isolation for AI agents, allowing them to execute tool-calls or AI-generated code in a fresh, kernel-enforced container that starts in approximately 3.5 milliseconds.

How it works

It operates as a single static binary with no daemon, utilizing Linux kernel features such as namespaces, pivot_root, and cgroup v2 limits. It supports OCI images and can be configured via a kern.toml file for resource profiles (CPU, memory, disk, and devices). For AI agents, it provides SDKs for Python and Node.js (kern-sandbox) and an MCP server (kern-mcp) to integrate with clients like Claude Desktop or Cursor.

Who it’s for

Developers building AI agents that require a secure, isolated environment to execute untrusted code or tool-calls, as well as developers needing a lightweight, rootless container runtime for local development and resource-slicing.

Highlights

• Ultra-fast startup: Starts a container from an OCI image in ~3.4 ms, significantly faster than Docker or Podman.
• Daemonless and Rootless: A single static binary that requires no background process and is always rootless.
• AI Agent Integration: Dedicated SDKs and an MCP server for easy integration into agentic workflows.
• Resource Profiling: Allows defining reusable CPU, memory, and disk slices via kern.toml.
• Docker Compose Compatibility: Can run docker-compose.yml files unchanged.
• Hardened Security: Uses a deny-by-default seccomp allowlist and drops 16 dangerous capabilities.