Enroot
github.com
What it is
Enroot is a free, open-source Linux command-line utility that turns traditional container and operating-system images into unprivileged sandboxes. It is aimed at high-performance or virtualized environments where portability and reproducibility matter and additional isolation is not required. Enroot runs without a daemon and supports unprivileged multi-user use without a setuid binary. Linux user and mount namespaces preserve filesystem separation, while the project provides little to no isolation. The command line covers batch, bundle, create, exec, export, import, list, remove, and start operations. It imports known formats including Docker, with the README reporting a 3x to 5x speedup for large Docker-image imports. Built-in GPU support uses libnvidia-container, and hooks can add NVIDIA support or Mellanox host MOFED. Runtime settings come from enroot.conf or higher-priority environment variables. Standard and hardened package flavors are available.
Spec sheet
- Purpose
- Enroot turns traditional container and OS images into unprivileged sandboxes.Read 8 Oct 2026 · github.com
- Integrations
- Standard hooks can provide NVIDIA GPU support and inject Mellanox host MOFED for InfiniBand HCA support into containers.Read 8 Oct 2026 · github.com
- License
- The project is released under the Apache License 2.0.Read 8 Oct 2026 · github.com
- Configuration
- Runtime configuration can be set in enroot.conf or through environment variables, which take precedence over the file.Read 8 Oct 2026 · github.com
- GPU support
- Built-in GPU support uses libnvidia-container, and the optional GPU requirements include NVIDIA drivers version 361.93 or later and libnvidia-container-tools version 1.0 or later.Read 8 Oct 2026 · github.com
- HPC use
- The project describes Enroot as suited to high-performance or virtualized environments where portability and reproducibility matter and extra isolation is not warranted.Read 8 Oct 2026 · github.com
- Image imports
- Enroot can import known container image formats, including Docker images, and the README reports a 3x to 5x speedup for importing large Docker images.Read 8 Oct 2026 · github.com
- Install platforms
- Installation instructions provide packages for Debian-based and RHEL-based distributions and source build instructions for Debian-, RHEL-, and Arch-based distributions.Read 8 Oct 2026 · github.com
- Isolation
- Enroot uses Linux user and mount namespaces and provides little to no isolation while preserving filesystem separation.Read 8 Oct 2026 · github.com
- Linux requirements
- Enroot requires Linux kernel 3.10 or later and kernel support for namespaces, user namespaces, and seccomp filters.Read 8 Oct 2026 · github.com
- Package options
- The project offers standard and hardened package flavors, and says the hardened flavor is slightly more secure but has greater overhead.Read 8 Oct 2026 · github.com
- Security reporting
- The security policy asks reporters to disclose vulnerabilities by emailing [email protected] instead of opening an issue or pull request.Read 8 Oct 2026 · github.com
- Unprivileged
- Enroot is standalone, requires no daemon, and supports unprivileged multi-user use without a setuid binary.Read 8 Oct 2026 · github.com
- Workflow features
- The command line supports batch, bundle, create, exec, export, import, list, remove, and start operations on container sandboxes.Read 8 Oct 2026 · github.com
Plans and prices
Enroot (Apache-2.0) Free Open-source command-line utility · Linux kernel >= 3.10 · standard and hardened package flavors Read 8 Oct 2026 · github.com
Strong points and limits
Strong points
- Free Apache-2.0 command-line utility
- Rootless multi-user operation without a daemon
- Docker image import with reported 3x–5x speedup
- Built-in NVIDIA GPU support
- Batch and interactive sandbox commands
Limits
- Provides little to no isolation
- Requires Linux kernel 3.10 or later
- GPU features require NVIDIA drivers and libnvidia-container
- Hardened flavor has greater overhead
Who it suits
Enroot suits Linux users managing portable container sandboxes in HPC or virtualized environments. It fits multi-user setups needing rootless operation and optional NVIDIA or InfiniBand integration.
Verdict
Enroot focuses on rootless, portable sandboxes rather than strong isolation. Its Linux command set, image importing, and GPU hooks make it suited to the environments described, provided the limited isolation matches your requirements.
Where Specifiction places it
- Container Engines#11 of 317.7
