- Home
- Container Engines
- Enroot
Enroot
What it is
Enroot is a free Linux command-line utility that turns container and operating system images into unprivileged sandboxes. The project positions it for high-performance computing and virtualized environments where portability and reproducibility matter, but extra isolation is not warranted. Enroot runs without a daemon and supports multi-user use without a setuid binary. It uses Linux user and mount namespaces to separate filesystems while providing little to no isolation. The command line supports batch, bundle, create, execute, export, import, list, remove, and start operations. It can import known container image formats, including Docker images; its README reports a 3x to 5x speedup for importing large Docker images. Built-in GPU support uses libnvidia-container, and hooks can provide NVIDIA GPU support or inject host MOFED for Mellanox InfiniBand HCA support. Runtime settings can be set in enroot.conf or with environment variables, which take precedence. The project offers standard and hardened package flavors, describing the hardened version as slightly more secure but with greater overhead. Enroot is released under the Apache License 2.0. It requires Linux kernel 3.10 or later with support for namespaces, user namespaces, and seccomp filters.
For and against
For
- Free utility released under Apache License 2.0.
- Runs without a daemon or setuid binary.
- Imports Docker and other known image formats.
- Includes GPU support through libnvidia-container.
Against
- Provides little to no isolation.
- Requires Linux kernel 3.10 or later.
- Hardened packages have greater overhead.
- Requires namespace and seccomp filter support.
The verdict
Enroot offers unprivileged sandbox workflows for Linux environments where portability matters more than stronger isolation. Its low-isolation design and kernel requirements are important considerations.
Who it suits
Enroot suits Linux users in high-performance computing or virtualized environments who need portable, reproducible sandboxes and do not require extra isolation.
Plans and prices
Enroot (Apache-2.0)
Open-source command-line utility · Linux kernel >= 3.10 · standard and hardened package flavors
Read 8 Oct 2026 · github.com
On the record
- Configuration
- Runtime configuration can be set in enroot.conf or through environment variables, which take precedence over the file.github.com · read 8 Oct 2026
- GPU support
- Built-in GPU support uses libnvidia-container, and the optional GPU requirements include NVIDIA drivers version 361.93 or later and libnvidia-container-tools version 1.0 or later.github.com · read 8 Oct 2026
- HPC use
- The project describes Enroot as suited to high-performance or virtualized environments where portability and reproducibility matter and extra isolation is not warranted.github.com · read 8 Oct 2026
- Image imports
- Enroot can import known container image formats, including Docker images, and the README reports a 3x to 5x speedup for importing large Docker images.github.com · read 8 Oct 2026
- Install platforms
- Installation instructions provide packages for Debian-based and RHEL-based distributions and source build instructions for Debian-, RHEL-, and Arch-based distributions.github.com · read 8 Oct 2026
- Integrations
- Standard hooks can provide NVIDIA GPU support and inject Mellanox host MOFED for InfiniBand HCA support into containers.github.com · read 8 Oct 2026
- Isolation
- Enroot uses Linux user and mount namespaces and provides little to no isolation while preserving filesystem separation.github.com · read 8 Oct 2026
- License
- The project is released under the Apache License 2.0.github.com · read 8 Oct 2026
- Linux requirements
- Enroot requires Linux kernel 3.10 or later and kernel support for namespaces, user namespaces, and seccomp filters.github.com · read 8 Oct 2026
- Package options
- The project offers standard and hardened package flavors, and says the hardened flavor is slightly more secure but has greater overhead.github.com · read 8 Oct 2026
- Purpose
- Enroot turns traditional container and OS images into unprivileged sandboxes.github.com · read 8 Oct 2026
- Security reporting
- The security policy asks reporters to disclose vulnerabilities by emailing [email protected] instead of opening an issue or pull request.github.com · read 8 Oct 2026
- Unprivileged
- Enroot is standalone, requires no daemon, and supports unprivileged multi-user use without a setuid binary.github.com · read 8 Oct 2026
- Workflow features
- The command line supports batch, bundle, create, exec, export, import, list, remove, and start operations on container sandboxes.github.com · read 8 Oct 2026
