Nestybox
AcquiredYC S20San Francisco, US Β· Founded 2019 Β· 2 employees Β· 2 known investors
Acquired by DotCloud May 2022 Β· terms undisclosed β Container isolation and secure system-container technology. Β· source β
Nestybox develops a container runtime called Sysbox that integrates with Docker and Kubernetes to allow containers to function with VM-like isolation and flexibility. The software targets enterprises seeking a more cost-effective and portable alternative to traditional virtual machines.
Also known as Inc. Β· Nestybox, Inc.
Founders & leadershipΒ· Y Combinator alumni (S20)
Nestybox was founded in 2019 by Cesar Talledo and Rodny Molina.
Investors Β· 2
Company profile
researched Aug 2026Nestybox is a developer-tools company founded in 2019 that created Sysbox, a container runtime β a specialized fork of the OCI "runc" β that allows Linux containers to run system-level software such as systemd, Docker, Kubernetes, K3s and buildx without privileged containers, custom images or special entrypoints. The company describes the resulting containers as "system containers": environments that behave like virtual machines while remaining containers, intended for development, local testing, CI/CD pipelines, running legacy applications, and replacing VMs in scenarios where nested virtualization or hypervisor overhead is undesirable.
Sysbox works beneath OCI-compatible container managers and orchestrators such as Docker/containerd and Kubernetes, so users deploy containers with familiar commands (for example, `docker run --runtime=sysbox-runc`). It improves isolation by always enabling the Linux user namespace (mapping container root to an unprivileged host user), virtualizing portions of procfs and sysfs inside the container, hiding host information and locking initial mounts. Technically it also uses uid shifting via shiftfs, selective syscall trapping in user space and special mounts. Unlike VM-based runtimes such as Kata Containers and KubeVirt, Sysbox does not use virtual machines, trading some isolation strength for easier use and better efficiency in cloud environments. Sysbox can coexist with other runtimes on the same host and installs on bare-metal, VM, on-prem and cloud Linux hosts, including managed Kubernetes services such as GKE, EKS and AKS.
The company was part of Y Combinator's Summer 2020 batch and open-sourced Sysbox under the Apache License 2.0 in August 2020, while offering a proprietary Sysbox Enterprise Edition. Docker acquired Nestybox in May 2022; Sysbox remains a community open-source project sponsored by Docker but is not covered by Docker subscription support.
Founding story
Nestybox was co-founded in 2019 by Cesar Talledo and Rodny Molina, two software engineers with roughly two decades of experience each. Talledo previously worked at VMware (including as an ESX kernel developer) and Integrated Device Technologies, and studied at UC Irvine and Santa Clara University; Molina worked on distributed network systems and data-center infrastructure at LinkedIn, Ericsson, Juniper Networks, Lucent and Broadnet, and holds a B.S. in computer science from the University of Illinois. The founders started the company after observing that containers handled microservices well but struggled to run system-level software: doing so required insecure privileged containers with complex images, custom entrypoints and volume mounts, or a heavier virtual machine. They identified gaps in the container abstraction β limited root capabilities inside the container, incomplete namespacing of procfs and sysfs, and overlayfs-on-overlayfs limitations β and forked the OCI runc in early 2019 to build Sysbox in Go.
Business model
Nestybox used an open-core model: the Sysbox runtime is free and open source under Apache 2.0, while the company sold Sysbox Enterprise Edition (Sysbox-EE), a commercial version built on the open-source core with additional proprietary enterprise features.
Revenue was intended to come from sales of the proprietary Sysbox Enterprise Edition to enterprises, layered on top of the freely available open-source runtime.
Traction
The open-source Sysbox repository on GitHub has approximately 3,800 stars, 227 forks and over 1,900 commits. Nestybox's Docker Hub organization publishes 47 repositories; its Alpine + Docker system container image has surpassed one million pulls, and several images, including sysbox-deploy-k8s, ubuntu-jammy-systemd-docker and kindestnode, exceed 10,000 pulls. The 2020 Hacker News launch post drew 168 points and 111 comments. Y Combinator lists a team size of 2.
Latest developments
Following the May 2022 acquisition, Sysbox continues as a community open-source project sponsored by Docker, with support provided on a best-effort basis through GitHub and the Sysbox Slack workspace rather than through Docker subscriptions. Newer container images, such as Ubuntu Noble-based system containers, have been published to the Nestybox Docker Hub organization.
βΈFull profile β market position, technology, go-to-market, geography, history, risks & controversies
Market position
Nestybox positioned Sysbox in the container virtualization market as a middle ground between standard containers and VM-based runtimes such as Kata Containers and KubeVirt, which run workloads inside lightweight virtual machines, and system container managers such as LXD. Following the Docker acquisition, Sysbox technology became associated with Docker's container platform.
Sysbox enables unprivileged containers to run system-level workloads without using virtual machines, avoiding nested virtualization in cloud environments and preserving container start-up speed and density β the project claims roughly twice the density of VMs on the same hardware at the same performance. It requires no changes to existing images, tooling or workflows, needs no privileged containers or host Docker socket mounts, and can run side by side with other runtimes on the same host. The trade-off, as stated by the project, is that it does not provide the level of isolation offered by VM-based runtimes.
Technology
Sysbox is written in Go and was forked from the OCI runc in early 2019. It applies OS-virtualization techniques rather than hardware virtualization: always-on Linux user namespaces so container root maps to an unprivileged host user, uid shifting via shiftfs, partial virtualization of procfs and sysfs, selective syscall trapping in user space, hiding host information from the container, locking the container's initial mounts, and configuring special mounts inside the container. It plugs in below OCI-based container managers, so existing images and workflows require no modification. Components in the open-source repository include sysbox-runc, sysbox-fs, sysbox-mgr, sysbox-ipc and Kubernetes deployment manifests. The company also publishes system container images on Docker Hub, including Ubuntu- and Alpine-based images preloaded with systemd, Docker, and the Kubernetes KinD tool.
Go-to-market
Nestybox pursued a developer-led approach: open-sourcing Sysbox on GitHub under Apache 2.0, distributing system container images through Docker Hub, publishing technical blog posts on use cases such as Docker-in-Docker, Kubernetes-in-Docker, Jenkins, Drone.io and GitLab CI pipelines, launching publicly via Hacker News as a Y Combinator Summer 2020 company, and offering free downloads from its website alongside a paid enterprise edition. Community support is provided through the GitHub repository and a Sysbox Slack workspace.
Software engineers and enterprises using containers for development environments, local testing, CI/CD pipelines (including Docker-in-Docker and Kubernetes-in-Docker), running legacy applications, and partitioning bare-metal hosts or cloud instances into isolated compute environments as an alternative to virtual machines.
Geography
Y Combinator lists Nestybox in San Francisco; the company's Docker Hub profile and a company data profile list San Jose, California. Sysbox runs on Linux hosts across bare-metal, on-premises, VM and cloud environments, and on major cloud IaaS and managed Kubernetes services including EC2, GCP, GKE, EKS, AKS and Rancher.
History
Founded in 2019, Nestybox forked the OCI runc in early 2019 to build Sysbox and began publishing technical content on system containers in September 2019. It joined Y Combinator's Summer 2020 batch and open-sourced Sysbox under Apache 2.0 in August 2020, announcing it via a Launch HN post, while commercializing a Sysbox Enterprise Edition. In November 2020 it was named among the first sixteen portfolio companies of SoftBank's $100 million Opportunity Fund. Docker acquired Nestybox in May 2022, after which Docker became the main sponsor of the Sysbox open-source project.
Risks & controversies
Sysbox does not provide the level of isolation offered by VM-based runtimes such as Kata Containers and KubeVirt. It requires true root privileges and therefore cannot itself run nested inside a Sysbox-deployed system container. After the Docker acquisition, Sysbox is not officially supported by Docker and receives only best-effort community support.
Compiled by commissioned research from 8 cited public sources β announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed β not independently audited.
Competitors Β· 5
by search overlap
Companies competing with Nestybox for the same Google search keywords, organic and paid, via search-intersection analysis.
Timeline Β· 4
launches, deals, and filingsNestybox, the original developer of the Sysbox container runtime, was acquired by Docker; Docker became the main sponsor of the open-source Sysbox project, though Sysbox is not officially supported under Docker subscriptions.
Nestybox was listed among the first sixteen portfolio companies of SoftBank's $100 million Opportunity Fund, which backs startups led by Black, Latinx and Native American founders. Individual investment sizes were not disclosed.
Co-founders Cesar Talledo and Rodny Molina announced on Hacker News (Launch HN, YC S20) that Sysbox was being open-sourced under the Apache 2.0 license and published on GitHub, alongside plans to sell a proprietary Sysbox Enterprise Edition.
Nestybox took part in Y Combinator's Summer 2020 accelerator batch.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
In the news
βΈResearch sources Β· 8
primary sources listed
- Nestybox Blog Site | Articles about running Docker, Kubernetes, and more inside containers, easily and securely.blog.nestybox.com Β· web
8 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Nestybox do?
- Nestybox builds Sysbox, a container runtime that lets Linux containers run system workloads like VMs; acquired by Docker in 2022.
- Who founded Nestybox?
- Nestybox was founded by Cesar Talledo, Rodny Molina in 2019.
- Who are Nestybox's investors?
- Nestybox's investors include Open Opportunity Fund, Y Combinator.
- Where is Nestybox headquartered?
- Nestybox is headquartered in San Francisco, US.