google / nsjail

A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.

containerd / cgroups

cgroups package for Go

DOCGroup / ACE_TAO

ACE and TAO

criyle / go-judge

Sandbox service built on Linux container technologies with simple REST and gRPC API

inevolin / k8s-cpu-limits-analyzed

Kubernetes CPU limits make your apps (very) slow and costly. CPU throttling analyzed, with proof.

bojieli / tunless

TUN-less transparent proxying: socket-layer flow capture that hands ordinary SOCKS5 to your existing proxy. No fake IP, no route hijack, no second TCP stack.

fior512 / goset

Noise-aware CPU pinning