kern - AI 생성 코드를 매번 새 컨테이너에서 실행하는 경량 루트리스 런타임

kern: rootless container runtime and sandbox with no daemon. Runs agent tool calls and LLM-generated code in kernel-enforced containers.

A real, kernel-enforced container in a few milliseconds, out of one static binary with no daemon.

MCP support for Claude Code, Cursor, Claude Desktop and LM Studio, through Kern Sandbox.

0 RAM at rest · no daemon, no socket, nothing to start · one static binary, libc its only Rust dependency

# Linux. Windows and macOS below.

curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh

What kern is

A rootless container runtime in one static binary, with no daemon. The same binary is the sandbox an

agent's code runs in, called from Python, Node or any MCP client. kern calls a container a box .

Real OCI images : pull , build , commit , push , save / load . A box starts in single-digit

milliseconds.

A sandbox for code your model wrote. It runs where it can't reach your files unless you hand

them over, with no network unless you ask.

No daemon, and root is never required. Six namespaces, a read-only or overlay root, a seccomp

allowlist by default, cgroup v2 limits.

Your docker-compose.yml , unchanged , or kern's own stack.toml .

Limits without a sandbox. kern run puts the same caps on a plain process on the host.

docs/RESOURCES.md

The tools you expect : ps , logs , exec , stats , inspect , top , doctor .

Install

curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh

irm https: // raw.githubusercontent.com / getkern / kern / main / install.ps1 | iex

brew install colima

colima start

colima ssh

Then, inside the VM:

curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh

Kern Sandbox goes in the VM too, with the code that calls it: pip install kern-sandbox there.

Then kern doctor checks the host and says what to fix. Ubuntu 23.10 and newer need one root step

first: docs/INSTALL.md .

Quickstart

What it does

Command

A shell in a real OCI image

kern box dev --image alpine -it -- sh

A service, published on the host

kern box svc --image nginx:alpine -d -p 8080:80

Untrusted code, with the strict profile

kern box job --image python:3.12-slim --security-profile untrusted -- python3 -c "print('hi')"

What is running ( --json too)

kern ps

--security-profile untrusted is the seccomp allowlist, --cap-drop ALL and --read-only in one

flag. examples/ holds 94 runnable scripts, one per thing kern does.

Kern Sandbox: run an agent's code from Python or Node

In a terminal:

python3 -m venv .venv && . .venv/bin/activate

pip install -U kern-sandbox

Then in a Python file:

import kern_sandbox as kern

r = kern . run_code ( "print(sum(range(100)))" )

print ( r . stdout , r . fault ) # 4950 None

Your code runs in a container of its own, for one call or for a whole session, and a timeout or an

out-of-memory comes back as a typed fault . On Linux, pip brings kern with it, and so does

npm install kern-sandbox for Node.

These three and three more, ready to copy: the Python SDK ,

the same for Node .

MCP server for Claude Code, Cursor, Claude Desktop and LM Studio. The same block goes in

claude_desktop_config.json , in Cursor's or LM Studio's mcp.json , or in .mcp.json at your

project root for Claude Code:

{

"mcpServers" : {

"kern" : { "command" : " uvx " , "args" : [ " --from " , " kern-sandbox " , " kern-mcp " ] }

}

}

Every option: docs/MCP.md .

Run a whole stack: your docker-compose.yml , unchanged

# stack.toml - one table per service, keys spelled like the `kern box` flags

[ box . cache ]

image = " redis:7-alpine "

[ box . web ]

image = " nginx:alpine "

ports = [ " 8080:80 " ]

depends_on = [ " cache " ]

kern compose stack.toml up # start it (or point it at your compose.yaml)

kern compose stack.toml ps # what is running, and what each service publishes

kern compose stack.toml port web 80 # the host address serving a port

Each service gets its own network namespace and they reach each other by name.

docs/DOCKER-COMPAT.md

Speed and footprint

one isolated /bin/true

kern is

one container, against docker run --rm

80x faster

200 at once, against docker run --rm

130x faster

one container, against rootless runc

3.6x faster

kern

Docker

Podman

Daemon

no

yes ( dockerd + containerd )

no

Resident memory, nothing running

0

154 to 160 MB

0

Root required

never

opt-in to avoid it

never

Same machine, same workload, same day, rounded down. The method and every runtime:

BENCHMARKS.md .

Security

Namespaces, a pivot_root , dangerous capabilities dropped before exec, an always-on seccomp

allowlist that keeps kern's 35 escape syscalls denied, cgroup v2 limits and a deny-by-default

/dev . Where a boundary is cooperative rather

than kernel-enforced, SECURITY.md says so and names the bypass.

docs/CVE-POSTURE.md runs 25 published container-runtime escapes against this

tree, one at a time, and pentest/ asserts the boundaries against the kernel.

Report a vulnerability privately via GitHub Security Advisories or hello@getkern.dev .

Roadmap

In development: a VM tier and full GPU support. Under consideration: a desktop for computer use,

kern in a Kubernetes pod, snapshots, a kern command on macOS. Details: ROADMAP.md .

Documentation

Document

What is in it

docs/INSTALL.md · docs/FAQ.md

installing, and the questions people ask

docs/THREAT_MODEL.md · docs/CVE-POSTURE.md

the threat model, and every published container-runtime escape reproduced against this tree

docs/CONFIG.md · docs/EGRESS.md

the kern.toml schema, and egress

CHANGELOG.md

what changed in each release

Contributing

Issues and pull requests are welcome. CONTRIBUTING.md has the workflow and the

gates; contributions are covered by the CLA .

Maintainer

Alessandro Polito, @realexhub .

License

Apache-2.0. See LICENSE and TRADEMARK.md .

[GeekNews 페이지 요약]

AI가 생성한 코드, 에이전트 도구 호출, CI 작업 등을 호스트에서 직접 실행하지 않고 별도 컨테이너에 격리 하는 Linux 런타임 데몬이나 소켓 없이 정적 바이너리 하나로 동작 하며, 호스트의 root 권한 없이 실행됨 컨테이너가 없을 때 런타임의 상주 프로세스도 없어, 필요할 때 실행하고 종료하는 작업에 적합 /bin/true 를 실행후 종료하는 컨테이너로 테스트시 docker run --rm 에 비교해 1개만 실행시 약 80배 , 200개 동시 실행에서 약 130배 빠름 rootless runc 대비로는 약 3.6배 빠름 컨테이너 시작과 종료 비용을 줄여 도구 호출마다 새 실행 환경을 만들고 폐기 하는 방식을 기본으로 사용 가능 Python/Node SDK와 MCP