Enroot

What Enroot is

Enroot is a free, open-source Linux command-line utility that turns container and operating system images into unprivileged sandboxes. Its project describes it as suited to high-performance computing and virtualized environments where portability and reproducibility matter and extra isolation is not warranted. Enroot uses Linux user and mount namespaces to preserve filesystem separation, while providing little to no isolation.

The utility runs without a daemon and supports multi-user use without a setuid binary. Its commands cover batch, bundle, create, exec, export, import, list, remove, and start operations. It imports known container image formats, including Docker images; the README reports a 3x to 5x speedup for importing large Docker images.

Built-in GPU support uses libnvidia-container. Standard hooks can provide NVIDIA GPU support or inject Mellanox host MOFED for InfiniBand HCA support. Optional GPU requirements include NVIDIA drivers version 361.93 or later and libnvidia-container-tools version 1.0 or later. Runtime configuration can be set in enroot.conf or with environment variables, which take precedence. Enroot offers standard and hardened package flavors; the hardened flavor is described as slightly more secure but with greater overhead. It is released under Apache License 2.0 and requires Linux kernel 3.10 or later with support for namespaces, user namespaces, and seccomp filters.

Who it suits

Enroot suits Linux users in high-performance computing or virtualized environments who need portable, reproducible container sandboxes and can work with little to no isolation. It is also a fit for multi-user setups that need rootless operation without a daemon or setuid binary.

Limits

Enroot provides little to no isolation. It requires Linux kernel 3.10 or later with support for namespaces, user namespaces, and seccomp filters; optional GPU support also requires NVIDIA drivers version 361.93 or later and libnvidia-container-tools version 1.0 or later.

Getting started

1. Open the Enroot project on GitHub.
2. Check that the host runs Linux kernel 3.10 or later with namespace, user namespace, and seccomp filter support.
3. Install a package for a Debian-based or RHEL-based distribution, or build from source using the instructions for Debian, RHEL, or Arch.
4. Choose the standard or hardened package flavor.
5. Import a supported image, then use the command line to create and start a sandbox.
6. For optional GPU support, meet the listed NVIDIA driver and libnvidia-container-tools requirements.

Verdict

Pick Enroot for Linux container workflows where rootless operation, portability, and reproducibility matter more than strong isolation. Look elsewhere if your use case requires substantial isolation; Enroot is explicitly described as providing little to none.