Nestybox

Nestybox is a developer-tools company founded in 2019 that created Sysbox, a container runtime — a specialized fork of the OCI "runc" — that allows Linux containers to run system-level software such as systemd, Docker, Kubernetes, K3s and buildx without privileged containers, custom images or special entrypoints. The company describes the resulting containers as "system containers": environments that behave like virtual machines while remaining containers, intended for development, local testing, CI/CD pipelines, running legacy applications, and replacing VMs in scenarios where nested virtualization or hypervisor overhead is undesirable.

Sysbox works beneath OCI-compatible container managers and orchestrators such as Docker/containerd and Kubernetes, so users deploy containers with familiar commands (for example, `docker run --runtime=sysbox-runc`). It improves isolation by always enabling the Linux user namespace (mapping container root to an unprivileged host user), virtualizing portions of procfs and sysfs inside the container, hiding host information and locking initial mounts. Technically it also uses uid shifting via shiftfs, selective syscall trapping in user space and special mounts. Unlike VM-based runtimes such as Kata Containers and KubeVirt, Sysbox does not use virtual machines, trading some isolation strength for easier use and better efficiency in cloud environments. Sysbox can coexist with other runtimes on the same host and installs on bare-metal, VM, on-prem and cloud Linux hosts, including managed Kubernetes services such as GKE, EKS and AKS.

The company was part of Y Combinator's Summer 2020 batch and open-sourced Sysbox under the Apache License 2.0 in August 2020, while offering a proprietary Sysbox Enterprise Edition. Docker acquired Nestybox in May 2022; Sysbox remains a community open-source project sponsored by Docker but is not covered by Docker subscription support.

Founding story

Nestybox was co-founded in 2019 by Cesar Talledo and Rodny Molina, two software engineers with roughly two decades of experience each. Talledo previously worked at VMware (including as an ESX kernel developer) and Integrated Device Technologies, and studied at UC Irvine and Santa Clara University; Molina worked on distributed network systems and data-center infrastructure at LinkedIn, Ericsson, Juniper Networks, Lucent and Broadnet, and holds a B.S. in computer science from the University of Illinois. The founders started the company after observing that containers handled microservices well but struggled to run system-level software: doing so required insecure privileged containers with complex images, custom entrypoints and volume mounts, or a heavier virtual machine. They identified gaps in the container abstraction — limited root capabilities inside the container, incomplete namespacing of procfs and sysfs, and overlayfs-on-overlayfs limitations — and forked the OCI runc in early 2019 to build Sysbox in Go.

Business model

Nestybox used an open-core model: the Sysbox runtime is free and open source under Apache 2.0, while the company sold Sysbox Enterprise Edition (Sysbox-EE), a commercial version built on the open-source core with additional proprietary enterprise features.

Revenue was intended to come from sales of the proprietary Sysbox Enterprise Edition to enterprises, layered on top of the freely available open-source runtime.

Traction

The open-source Sysbox repository on GitHub has approximately 3,800 stars, 227 forks and over 1,900 commits. Nestybox's Docker Hub organization publishes 47 repositories; its Alpine + Docker system container image has surpassed one million pulls, and several images, including sysbox-deploy-k8s, ubuntu-jammy-systemd-docker and kindestnode, exceed 10,000 pulls. The 2020 Hacker News launch post drew 168 points and 111 comments. Y Combinator lists a team size of 2.

Latest developments

Following the May 2022 acquisition, Sysbox continues as a community open-source project sponsored by Docker, with support provided on a best-effort basis through GitHub and the Sysbox Slack workspace rather than through Docker subscriptions. Newer container images, such as Ubuntu Noble-based system containers, have been published to the Nestybox Docker Hub organization.