nucleus

nucleus subcommand [options] [image] [command]

nucleus is a lightweight, declarative container runtime aimed at ephemeral agent sandboxes and long-running production services. Rather than layering a heavy daemon on top, it drives Linux kernel primitives directly (namespaces, cgroups, seccomp, and Landlock) to create isolated execution environments with minimal overhead.It runs in distinct modes. The default agent mode creates ephemeral sandboxes with best-effort isolation, while strict agent mode is fail-closed: it refuses to start unless cgroup creation, seccomp filtering, and Landlock enforcement all succeed. A production mode targets long-running services with declarative configuration, reproducible root filesystems, egress policy, health checks, and systemd integration. Subcommands cover the usual lifecycle (run, create, ps, logs, stop, attach) plus multi-container topologies via compose and seccomp profile generation from syscall traces.

run

Create and start a container from an image or root filesystem.

Define a container from a JSON or TOML configuration without starting it.

List containers.

Show a container's output.

Stop a running container.

Attach to a running container's streams.

Bring up a multi-container topology.

Limit the container's memory.

Limit the number of CPUs.

Select the networking mode for the container.

Use the given root filesystem.

Apply a seccomp profile to the container.

Apply a Landlock filesystem access policy.

Run the container in the background.

nucleus relies on modern Linux kernel features such as cgroups v2, seccomp, and Landlock; strict agent mode fails closed when any of them are unavailable, so older kernels may only support the degraded agent mode. It is Linux-specific and not a drop-in replacement for the full Docker or OCI tooling ecosystem.

podman(1), docker(1), runc(8), bwrap(1), systemd-nspawn(1)

Source code