// HACKER NEWS — CYBERSECURITY
Show HN: Kern – container and resource runtime in a 1.5 MB binary, no daemon
kern: A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code.
A real, kernel-enforced container in ~3.5 ms, out of one 1.52 MB binary with no daemon.
0 RAM at rest · no daemon, no socket, nothing to start · one static binary, libc its only Rust dependency
One binary that manages resources, of which isolation is the first. That is why there is no
single row for kern in a comparison table: it is a container runtime, a sandbox, a resource slicer
and a stack runner at once, in 1.52 MB with no daemon.
Its entire Rust dependency tree is libc: JSON and OCI manifests are parsed by hand, and pull
shells out to the curl and tar already on the machine rather than linking a TLS stack. (1.52 MB
is the size-optimized release build; a plain cargo install from source is 1.91 MB.)
Not a hypervisor. The boundary is the Linux kernel, so a kernel privilege-escalation bug is an
escape. Docker and Podman share that condition, which is why gVisor and Firecracker exist.
Read with the tagline, that is one line seen from both sides: untrusted and AI-generated code is
what kern is FOR, because you chose to run it and own the blast radius (agent tool-calls, CI jobs,
build steps, code cells). What it is not for is hostile code from strangers, multi-tenant, on a
kernel you serve other tenants from. kern does start rootless always, where Docker's is opt-in.
Not free of the userns trade. Its isolation is built on an unprivileged user namespace, a
fertile source of kernel LPE bugs. SECURITY.md states this before any claim.
Not a wall around what you mount in. -v $HOME:/host gives the box your home directory: a
mount is a trust decision you make, not a boundary kern enforces. --net host and --privileged
are opt-outs by name. (The one path kern refuses to bind is its own runtime registry.)
Not a Docker Engine reimplementation. It speaks Docker's formats, not its API: no overlay
networks, no plugins, no Swarm. Matrix: docs/DOCKER-COMPAT.md.