Enroot vs Inclavare Containers
Enroot
github.comInclavare Containers
github.comSide by side
| Figure | Enroot | Inclavare Containers |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Engines | 7.7 (#11) | 7.6 (#13) |
| Integrations | Standard hooks can provide NVIDIA GPU support and inject Mellanox host MOFED for InfiniBand HCA support into containers. | The project documents integration with dockerd, containerd, and pouchd. |
| Isolation | Enroot uses Linux user and mount namespaces and provides little to no isolation while preserving filesystem separation. | It creates hardware-enforced isolation between a tenant’s workload and privileged software controlled by a cloud service provider. |
| Purpose | Enroot turns traditional container and OS images into unprivileged sandboxes. | Inclavare Containers is a container runtime for launching protected containers in hardware-assisted Trusted Execution Environments (TEEs). |
Plans
In their own words
Enroot
Enroot is a free, open-source Linux command-line utility that turns traditional container and operating-system images into unprivileged sandboxes. It is aimed at high-performance or virtualized environments where portability and reproducibility matter and additional isolation is not required. Enroot runs without a daemon and supports unprivileged multi-user use without a setuid binary. Linux user and mount namespaces preserve filesystem separation, while the project provides little to no isolation. The command line covers batch, bundle, create, exec, export, import, list, remove, and start operations. It imports known formats including Docker, with the README reporting a 3x to 5x speedup for large Docker-image imports. Built-in GPU support uses libnvidia-container, and hooks can add NVIDIA support or Mellanox host MOFED. Runtime settings come from enroot.conf or higher-priority environment variables. Standard and hardened package flavors are available.
Inclavare Containers
Inclavare Containers is a free, open-source Linux container runtime for launching protected containers in hardware-assisted Trusted Execution Environments. It creates hardware-enforced isolation between a tenant workload and privileged cloud-provider software. Its Enclave Attestation Architecture provides remote attestation that sensitive workloads run on trusted TEE hardware. The rune component is described as compliant with the OCI Runtime specification, while documented integrations include dockerd, containerd, and pouchd. Deployment can use Occlum LibOS or WebAssembly Micro Runtime, and Rats-TLS provides an attested secured channel between heterogeneous TEEs. shim-rune handles enclave signing and management between containerd and rune; epm manages cache pools for enclave startup. The project is cloud-platform agnostic and can run on public-cloud Kubernetes platforms. It supports Kubernetes CRI, uses the OCI image format, and documents Linux hosts including Ubuntu 18.04 and Alibaba Linux 2. Installation is described through source builds or RPM/DEB repositories.