miget/container-os repository overview

⁠Miget Container OS

Miget Container OS provides the base runtime used by Miget's⁠ Platform-as-a-Service and Cloud offerings. Each image bundles the tooling required to run container workloads inside a Miget MicroVM, delivering strong isolation while keeping familiar Docker or Podman workflows.

⁠What is a MicroVM?

Miget MicroVMs are lightweight virtual machines tailored for container execution. They boot a minimal userland, expose only the services required for workload orchestration, and rely on hardware virtualization for strong isolation. Compared with traditional nested containers, MicroVMs eliminate the need for user-namespace tricks or rootless shims-the workload runs with full privileges inside the VM while the host maintains isolation boundaries.

⁠Current Release: 1.1.0

⁠Component Versions

⁠Supported tags and respective Dockerfiles

• Alpine 3.21 dockerd

  1.1.0-alpine-3.21.8-dockerd, 1.1.0-alpine3.21-dockerd, 1.1.0-alpine3.21, alpine3.21, stable-alpine3.21-dockerd (dockerfiles/alpine/3.21/dockerd.Dockerfile⁠)

• Alpine 3.21 podman

  1.1.0-alpine-3.21.8-podman, 1.1.0-alpine3.21-podman, stable-alpine3.21-podman (dockerfiles/alpine/3.21/podman.Dockerfile⁠)

• Alpine 3.22 dockerd

  1.1.0-alpine-3.22.6-dockerd, 1.1.0-alpine3.22-dockerd, 1.1.0-alpine3.22, alpine3.22, stable-alpine3.22-dockerd (dockerfiles/alpine/3.22/dockerd.Dockerfile⁠)

• Alpine 3.22 podman

  1.1.0-alpine-3.22.6-podman, 1.1.0-alpine3.22-podman, stable-alpine3.22-podman (dockerfiles/alpine/3.22/podman.Dockerfile⁠)

• Alpine 3.23 dockerd

  1.1.0-alpine-3.23.6-dockerd, 1.1.0-alpine3.23-dockerd, 1.1.0-alpine3.23, alpine3.23, stable-alpine3.23-dockerd (dockerfiles/alpine/3.23/dockerd.Dockerfile⁠)

• Alpine 3.23 podman

  1.1.0-alpine-3.23.6-podman, 1.1.0-alpine3.23-podman, stable-alpine3.23-podman (dockerfiles/alpine/3.23/podman.Dockerfile⁠)

• Alpine 3.24 dockerd

  1.1.0-alpine-3.24.2-dockerd, 1.1.0-alpine3.24-dockerd, 1.1.0-alpine3.24, alpine3.24, latest-alpine, stable-alpine3.24-dockerd (dockerfiles/alpine/3.24/dockerd.Dockerfile⁠)

• Alpine 3.24 podman

  1.1.0-alpine-3.24.2-podman, 1.1.0-alpine3.24-podman, stable-alpine3.24-podman (dockerfiles/alpine/3.24/podman.Dockerfile⁠)

• Ubuntu 22.04 dockerd

  1.1.0-ubuntu-22.04-dockerd, 1.1.0-ubuntu22-dockerd, 1.1.0-ubuntu22, ubuntu22, stable-ubuntu22-dockerd (dockerfiles/ubuntu/22.04/dockerd.Dockerfile⁠)

• Ubuntu 22.04 podman

  1.1.0-ubuntu-22.04-podman, 1.1.0-ubuntu22-podman, stable-ubuntu22-podman (dockerfiles/ubuntu/22.04/podman.Dockerfile⁠)

• Ubuntu 24.04 dockerd

  1.1.0-ubuntu-24.04-dockerd, 1.1.0-ubuntu24-dockerd, 1.1.0-ubuntu24, ubuntu24, stable-ubuntu24-dockerd (dockerfiles/ubuntu/24.04/dockerd.Dockerfile⁠)

• Ubuntu 24.04 podman

  1.1.0-ubuntu-24.04-podman, 1.1.0-ubuntu24-podman, stable-ubuntu24-podman (dockerfiles/ubuntu/24.04/podman.Dockerfile⁠)

• Ubuntu 26.04 dockerd

  1.1.0-ubuntu-26.04-dockerd, 1.1.0-ubuntu26-dockerd, 1.1.0-ubuntu26, ubuntu26, latest, stable-ubuntu26-dockerd (dockerfiles/ubuntu/26.04/dockerd.Dockerfile⁠)

• Ubuntu 26.04 podman

  1.1.0-ubuntu-26.04-podman, 1.1.0-ubuntu26-podman, stable-ubuntu26-podman (dockerfiles/ubuntu/26.04/podman.Dockerfile⁠)

⁠Image Matrix

Images are generated from the templates in templates/ and published under the miget/container-os repository on Docker Hub. Variants exist for:

• Ubuntu 22.04, 24.04 & 26.04 with either dockerd or podman
• Alpine 3.21, 3.22, 3.23, 3.24 with either dockerd or podman

Concrete Dockerfiles are rendered into dockerfiles/<os>/<version>/<engine>.Dockerfile for each supported combination.

⁠Services Managed by Supervisord

Every image starts supervisord, which launches and supervises the following programs:

• sshd – Provides a fully functional remote shell for the miget user (SSH key-based)
• crond – Executes scheduled maintenance jobs inside the MicroVM
• dockerd or podman – Container runtime chosen by the image flavor

During boot the entrypoint script prepares /run/sshd, /var/run/sshd, /var/spool/cron, and runtime state for Podman when applicable.

⁠Docker Network MTU

dockerd variants start dockerd with the MTU of eth0, applied to the default bridge and to new networks, so containers never send packets larger than the VM network carries. Set DOCKERD_MTU to use another value, or DOCKERD_MTU=off to keep Docker's default. Values already set in /etc/docker/daemon.json take precedence.

⁠Running the Images Locally

All flavors expect privileged execution. When testing, run with --privileged (or the equivalent in your orchestration system) and map ports as needed for SSH.

⁠Ubuntu with dockerd

docker run --rm -d \
  --name miget-ubuntu-dockerd \
  --privileged \
  -p 2222:22 \
  miget/container-os:latest

⁠Ubuntu with podman

docker run --rm -d \
  --name miget-ubuntu-podman \
  --privileged \
  -p 2223:22 \
  miget/container-os:ubuntu24-podman

⁠Alpine with dockerd

docker run --rm -d \
  --name miget-alpine-dockerd \
  --privileged \
  -p 2224:22 \
  miget/container-os:alpine3.22

⁠Alpine with podman

docker run --rm -d \
  --name miget-alpine-podman \
  --privileged \
  -p 2225:22 \
  miget/container-os:alpine3.22-podman

These commands expose SSH on the host for troubleshooting; docker-in-docker or podman-in-podman operations will use the runtime inside the MicroVM.

⁠Default User and SSH Access

Each image creates a passwordless miget user (UID/GID 1000) with an empty /home/miget/.ssh/authorized_keys. Supply your public key by mounting a file when launching the container:

docker run --rm -d \
  --name miget-ubuntu-dockerd \
  --privileged \
  -p 2222:22 \
  -v $(pwd)/authorized_keys:/home/miget/.ssh/authorized_keys:ro \
  miget/container-os:latest

Permissions on the directory (700) and file (600) are enforced by the image. Connect using:

ssh -p 2222 miget@localhost

⁠Privileged Environment Requirements

All images are intended to run with full privileges. This matches Miget's MicroVM execution model and avoids brittle rootless/container hacks. When running under Kubernetes or Docker, ensure the pod or container is privileged; the workflows expect access to /dev/fuse, iptables, and kernel features commonly restricted in non-privileged contexts.

⁠Contributing

See DEVELOPMENT.md for contributor workflow details, including local development setup, manifest updates, validation, and publishing pipelines.

⁠License

Copyright © 2025 Miget⁠

Licensed under the Apache License, Version 2.0. See LICENSE⁠ for details.