mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Cloud platform and compute
container-runtime
container runtime and isolation
containerd, gVisor
System
Techniques · 2
Primitives · 19
container-runtime
Syscall interception
security · medium: Intercept syscalls via ptrace, seccomp user notify or a user-space kernel
Lazy image pulling
systems · medium: Start containers before full download by fetching image chunks on demand
Seccomp bpf
security · low: Syscall filtering with seccomp BPF programs
Oci image layout
systems · low: OCI manifests, image index, layer tarballs and config, addressed by digest
Deflate
compression · low: DEFLATE/gzip: LZ77 + Huffman, the format behind HTTP gzip, zip and PNG
Cgroups and namespaces
hardware-os · low: Linux namespaces limit what a process can see; cgroup v2 limits and accounts what it may use. Containers, sandboxes and job schedulers are built from the two.
›
Overlay filesystem
hardware-os · low: Union mounts (overlayfs) stacking read-only layers under a writable layer
Resource usage accounting
hardware-os · low: Cgroup/procfs/GPU counters sampled into per-workload usage
Virtual network interfaces
networking · low: Veth, bridges, tap and macvlan devices
Least privilege and isolation
security · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.
›
Content-addressed storage
storage · low: Store each blob under the hash of its bytes: immutable, deduplicated by construction, self-verifying on every read, and composable into Merkle trees.
›
Copy on write snapshots
storage · low: Point-in-time snapshots by sharing pages/extents and copying only on write
Tar archive format
storage · low: Ustar/pax tar headers and streaming archives
Ebpf
hardware-os · low: Verified in-kernel programs on hooks (kprobes, XDP, tc) with maps
Ptrace process control
hardware-os · low: Ptrace: attach, read and write registers and memory, single-step, intercept signals
Seekable compressed stream
compression · low: Independently compressed blocks plus an index for random access (BGZF, seekable zstd, eStargz)
Fuse userspace filesystem
hardware-os · low: FUSE protocol: kernel forwards VFS requests to a userspace daemon; caching and splice
HTTP range requests
networking · low: Ask for byte offsets with Range and get a 206 slice back; the standard way to resume, seek and read big remote files piecewise.
›
+ 3 more primitives
System
Techniques · 2
Primitives · 19
container-runtime
Syscall interception
security · medium: Intercept syscalls via ptrace, seccomp user notify or a user-space kernel
Lazy image pulling
systems · medium: Start containers before full download by fetching image chunks on demand
Seccomp bpf
security · low: Syscall filtering with seccomp BPF programs
Oci image layout
systems · low: OCI manifests, image index, layer tarballs and config, addressed by digest
Deflate
compression · low: DEFLATE/gzip: LZ77 + Huffman, the format behind HTTP gzip, zip and PNG
Cgroups and namespaces
hardware-os · low: Linux namespaces limit what a process can see; cgroup v2 limits and accounts what it may use. Containers, sandboxes and job schedulers are built from the two.
›
Overlay filesystem
hardware-os · low: Union mounts (overlayfs) stacking read-only layers under a writable layer
Resource usage accounting
hardware-os · low: Cgroup/procfs/GPU counters sampled into per-workload usage
Virtual network interfaces
networking · low: Veth, bridges, tap and macvlan devices
Least privilege and isolation
security · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.
›
Content-addressed storage
storage · low: Store each blob under the hash of its bytes: immutable, deduplicated by construction, self-verifying on every read, and composable into Merkle trees.
›
Copy on write snapshots
storage · low: Point-in-time snapshots by sharing pages/extents and copying only on write
Tar archive format
storage · low: Ustar/pax tar headers and streaming archives
Ebpf
hardware-os · low: Verified in-kernel programs on hooks (kprobes, XDP, tc) with maps
Ptrace process control
hardware-os · low: Ptrace: attach, read and write registers and memory, single-step, intercept signals
Seekable compressed stream
compression · low: Independently compressed blocks plus an index for random access (BGZF, seekable zstd, eStargz)
Fuse userspace filesystem
hardware-os · low: FUSE protocol: kernel forwards VFS requests to a userspace daemon; caching and splice
HTTP range requests
networking · low: Ask for byte offsets with Range and get a 206 slice back; the standard way to resume, seek and read big remote files piecewise.
›
Merkle dag
data-structures · low: Content-addressed DAG of hashed nodes (git trees/commits) for dedupe and verifiable history
Atomic file replacement
hardware-os · low: Write temp file, fsync, rename over target, fsync directory: crash-safe whole-file updates
Cryptographic hashes (SHA-2, BLAKE3)
security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.
›
Copy for AI
Similar systems
Share the most building blocks with this one.
container-build
35 %
image-snapshotter
18 %
agent-sandbox
18 %