Sandbox service built on Linux container technologies with simple REST and gRPC API

pmdaemon service

Sandbox service built on Linux container technologies with simple REST and gRPC API.

Go library for configuring cgroup v2

Java agent to patch Gradle 8.x with cgroup v2 support for better memory detection in containers

Lightweight Prometheus exporter for Docker container metrics — built for ARM64 and cgroup v2

Lightweight Prometheus exporter for Docker container metrics, memory, CPU, network, disk I/O, and container state, without the overhead of cAdvisor.

A small eBPF-based sandboxing tool designed to block any attempt by a process or its descendants to escalate to root with setuid() / setreuid() / setresuid().

A Prometheus-compatible metrics exporter that monitors container resource usage of Kubernetes workloads.

Manages Linux cgroup configuration across Debian/Ubuntu and RedHat/AlmaLinux/Rocky/Fedora. Ensures persistent kernel parameters via GRUB updates and reboots when changes are applied.

Per-process Linux network gate — Little Snitch for Linux, built on Rust + Aya eBPF. Watch outbound connections, allow/deny per process, throttle per-PID bandwidth via tc-bpf.