You can now run same OCI images as containers or Firecracker microVMs

Posted by pullrun 1 day ago

Comments

Comment by aliasxneo 1 day ago

Is the OP the author of this? Because they are writing responses here that are unquestionably unedited LLM generated responses. The project looks cool, and I'm particularly glad to see a reach for a p2p container registry, but that sort of behavior doesn't lend credibility to something as critical as image infrastructure.

Comment by Izmaki 1 day ago

Unrelated: I clicked your user profile and wondered what that keybase.io thing was... turns out your proof expired and should no longer be trusted. :P

"That identity proof for <name> is pending, revoked, or non-existent".

Comment by add-sub-mul-div 1 day ago

It looks like OP only has an account here to self-promote, which also puts them in the same credibility tier as an advertiser.

Comment by themgt 1 day ago

There's actually two additional sockpuppet accounts (liquid64 / yakimbo90) in here self-promoting. Whole thing is throwing off a ton of red flags.

Comment by aliasxneo 1 day ago

You're right, this is a duplicate of: https://news.ycombinator.com/item?id=48910087.

Comment by wiether 1 day ago

I hate how I feel about this: the sole contributor's account is not 2 month old, and yet they have created an org for this project, with all the bells and whistles in the README.

To me, a project that young, with a unique developer at the helm, cannot look "that nice", so I can't resist seeing it as too nice to be true, and being actually a scam or whatever.

I know that, thanks to AI, a solo dev can not only orchestrate an actual projects in a few days, but can ALSO take time to make a good looking README.

When, in the past, the focus was first on the code, then on the README.

Comment by pullrun 1 day ago

[flagged]

Comment by Izmaki 1 day ago

> Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI.

It is my understanding that Docker Engine adds capabilities (such as network stack) on top of Containerd (which is a project maintained by the same people), and "CRI for Kubernetes" is a Container Runtime Interface which COULD be something other than Containerd but often is just Containerd. So in essence the reason why yet another runtime exists is that we have a runtime for containers (Docker/Containerd, Containerd and, for example, Containerd as the CRI in K8s), a runtime for isolation and a runtime for AI agents.

That seems like an unnecessary argument on its own, which makes me wonder why it's listed as the first argument.

Comment by Izmaki 1 day ago

Ps: I fear the day keyboards will ship with a "—" button, so we can no longer easily identify AI generated text.

Comment by vaylian 1 day ago

Sweet. I had hoped for someone to make a p2p container registry eventually. There is too much centralization with the current popular registries.

Comment by miladyincontrol 1 day ago

"memmap2" link in readme is broken btw, I think your llm means memmap-rs

Comment by ranger_danger 1 day ago

Where does the microvm kernel/initrd come from? How can it be built?

I just want a system that's as easy as "docker run ubuntu" but launches as a microvm instead, without me having to source a kernel or remember hugenormously long qemu incantation lines.

Comment by v_elem 1 day ago

Looks like everyone is converging on the same idea these days :-)

You might be interested in my project then: https://github.com/virtkit-dev/virtkit (also inspired by smolvm and similar projects). Default kernel included, but can also boot a custom kernel if necessary.

I built it at work to replace years of accumulated tooling around complex multi-stage docker/docker-compose builds. The same workloads now run more securely, often faster, and with much less disk space. Also acts as a Gitlab executor to run CI jobs in microvms :-)

Obviously built with AI (this would otherwise have been a multi-year effort... and therefore not exist at all!) but I think the design is not bad.

Still beta and under-documented, but already quite usable.

Edit: it's not just a runtime, it also replaces docker build with its own native build engine — the build steps themselves run inside microVMs (not "docker inside a VM"). I haven't seen any other tool actually do that, that's quite fun ;-)

Comment by jtbaker 1 day ago

I think `smolvm` may fit the bill? I've been using it to run pi.dev in a sandbox.

https://smolmachines.com/

Comment by ranger_danger 1 day ago

I tried smolvm, and built several single binaries with it for different distros. Less than a month later, those same binaries now silently exit with code 0 and I have absolutely no idea what's wrong or how to diagnose.

Comment by thepoet 1 day ago

We will be soon including this in Tarit, a firecracker alternative https://github.com/instavm/tarit

Currently we have to supply a kernel to run the OCI as a microVM with a warm pool.

  TARIT_KERNEL=/path/vmlinux

  taritd image build --oci ubuntu:24.04 --name ubuntu
  taritd vm create --image ubuntu

Comment by liquid64 1 day ago

The kernel/initrd come from a regular OCI container image — there's no separate VM image format. Any OCI image containing /boot/vmlinux (and optionally /boot/initramfs.cpio.gz) works as a kernel image.

Comment by ktm5j 1 day ago

I don't think I've ever seen a kernel or initrd in a container image. The whole point of containers is not to duplicate the kernel, and you definitely don't need an initial ram disk since you already have a running operating system.

Comment by pullrun 1 day ago

[flagged]

Comment by spwa4 1 day ago

And if they don't have a kernel? You just specify kernel + initrd?

Comment by yakimbo90 1 day ago

you don't have to source one manually — pullrun kernel install fetches a kata containers kernel into ~/.pullrun/kernels/vmlinux-<version>. One-time setup, then the daemon auto-discovers it.

Comment by moondev 1 day ago

If you run an ubuntu image with a kata kernel, do you have difficulty installing some packages? For example if you need linux-headers-$(uname -r) or linux-modules-extra-$(uname -r), it won't exist in canonical apt repos?

Comment by 1 day ago

Comment by pullrun 1 day ago

[flagged]

Comment by 1 day ago

Comment by pullrun 1 day ago

[flagged]

Comment by sureglymop 1 day ago

You can do this with libkrun. I use it as a podman backend which works exactly as you describe here.

    podman run --rm -it --runtime=krun ubuntu sh

Comment by ranger_danger 1 day ago

Error: default OCI runtime "krun" not found: invalid argument

Comment by sureglymop 1 day ago

Oh, you do need to install it. e.g. on arch: https://archlinux.org/packages/extra/x86_64/krun/

Comment by ranger_danger 1 day ago

I do have both podman and crun installed, but I don't see any krun or libkrun packages for ubuntu unfortunately :/

Comment by sureglymop 19 hours ago

That's unfortunate. I'm sorry, I should have checked that before recommending. Looks like your only option from an ubuntu host is to build from source.

Comment by pullrun 16 hours ago

[flagged]

Comment by 16 hours ago

Comment by 1 day ago