miget/container-os repository overview

⁠Miget Container OS

Miget Container OS provides the base runtime used by Miget's⁠ Platform-as-a-Service and Cloud offerings. Each image bundles the tooling required to run container workloads inside a Miget MicroVM, delivering strong isolation while keeping familiar Docker or Podman workflows.

⁠What is a MicroVM?

Miget MicroVMs are lightweight virtual machines tailored for container execution. They boot a minimal userland, expose only the services required for workload orchestration, and rely on hardware virtualization for strong isolation. Compared with traditional nested containers, MicroVMs eliminate the need for user-namespace tricks or rootless shims-the workload runs with full privileges inside the VM while the host maintains isolation boundaries.

⁠Current Release: 1.0.28

⁠Component Versions

⁠Supported tags and respective Dockerfiles

• Alpine 3.19 dockerd

  1.0.28-alpine-3.19.9-dockerd, 1.0.28-alpine3.19-dockerd, 1.0.28-alpine3.19, alpine3.19, stable-alpine3.19-dockerd (dockerfiles/alpine/3.19/dockerd.Dockerfile⁠)

• Alpine 3.19 podman

  1.0.28-alpine-3.19.9-podman, 1.0.28-alpine3.19-podman, stable-alpine3.19-podman (dockerfiles/alpine/3.19/podman.Dockerfile⁠)

• Alpine 3.20 dockerd

  1.0.28-alpine-3.20.10-dockerd, 1.0.28-alpine3.20-dockerd, 1.0.28-alpine3.20, alpine3.20, stable-alpine3.20-dockerd (dockerfiles/alpine/3.20/dockerd.Dockerfile⁠)

• Alpine 3.20 podman

  1.0.28-alpine-3.20.10-podman, 1.0.28-alpine3.20-podman, stable-alpine3.20-podman (dockerfiles/alpine/3.20/podman.Dockerfile⁠)

• Alpine 3.21 dockerd

  1.0.28-alpine-3.21.7-dockerd, 1.0.28-alpine3.21-dockerd, 1.0.28-alpine3.21, alpine3.21, stable-alpine3.21-dockerd (dockerfiles/alpine/3.21/dockerd.Dockerfile⁠)

• Alpine 3.21 podman

  1.0.28-alpine-3.21.7-podman, 1.0.28-alpine3.21-podman, stable-alpine3.21-podman (dockerfiles/alpine/3.21/podman.Dockerfile⁠)

• Alpine 3.22 dockerd

  1.0.28-alpine-3.22.5-dockerd, 1.0.28-alpine3.22-dockerd, 1.0.28-alpine3.22, alpine3.22, latest-alpine, stable-alpine3.22-dockerd (dockerfiles/alpine/3.22/dockerd.Dockerfile⁠)

• Alpine 3.22 podman

  1.0.28-alpine-3.22.5-podman, 1.0.28-alpine3.22-podman, stable-alpine3.22-podman (dockerfiles/alpine/3.22/podman.Dockerfile⁠)

• Ubuntu 22.04 dockerd

  1.0.28-ubuntu-22.04-dockerd, 1.0.28-ubuntu22-dockerd, 1.0.28-ubuntu22, ubuntu22, stable-ubuntu22-dockerd (dockerfiles/ubuntu/22.04/dockerd.Dockerfile⁠)

• Ubuntu 22.04 podman

  1.0.28-ubuntu-22.04-podman, 1.0.28-ubuntu22-podman, stable-ubuntu22-podman (dockerfiles/ubuntu/22.04/podman.Dockerfile⁠)

• Ubuntu 24.04 dockerd

  1.0.28-ubuntu-24.04-dockerd, 1.0.28-ubuntu24-dockerd, 1.0.28-ubuntu24, ubuntu24, latest, stable-ubuntu24-dockerd (dockerfiles/ubuntu/24.04/dockerd.Dockerfile⁠)

• Ubuntu 24.04 podman

  1.0.28-ubuntu-24.04-podman, 1.0.28-ubuntu24-podman, stable-ubuntu24-podman (dockerfiles/ubuntu/24.04/podman.Dockerfile⁠)

⁠Image Matrix

Images are generated from the templates in templates/ and published under the miget/container-os repository on Docker Hub. Variants exist for:

• Ubuntu 22.04 & 24.04 with either dockerd or podman
• Alpine 3.19, 3.20, 3.21, 3.22 with either dockerd or podman

Concrete Dockerfiles are rendered into dockerfiles/<os>/<version>/<engine>.Dockerfile for each supported combination.

⁠Services Managed by Supervisord

Every image starts supervisord, which launches and supervises the following programs:

• sshd – Provides a fully functional remote shell for the miget user (SSH key-based)
• crond – Executes scheduled maintenance jobs inside the MicroVM
• dockerd or podman – Container runtime chosen by the image flavor

During boot the entrypoint script prepares /run/sshd, /var/run/sshd, /var/spool/cron, and runtime state for Podman when applicable.

⁠Running the Images Locally

All flavors expect privileged execution. When testing, run with --privileged (or the equivalent in your orchestration system) and map ports as needed for SSH.

⁠Ubuntu with dockerd

docker run --rm -d \
  --name miget-ubuntu-dockerd \
  --privileged \
  -p 2222:22 \
  miget/container-os:latest

⁠Ubuntu with podman

docker run --rm -d \
  --name miget-ubuntu-podman \
  --privileged \
  -p 2223:22 \
  miget/container-os:ubuntu24-podman

⁠Alpine with dockerd

docker run --rm -d \
  --name miget-alpine-dockerd \
  --privileged \
  -p 2224:22 \
  miget/container-os:alpine3.22

⁠Alpine with podman

docker run --rm -d \
  --name miget-alpine-podman \
  --privileged \
  -p 2225:22 \
  miget/container-os:alpine3.22-podman

These commands expose SSH on the host for troubleshooting; docker-in-docker or podman-in-podman operations will use the runtime inside the MicroVM.

⁠Default User and SSH Access

Each image creates a passwordless miget user (UID/GID 1000) with an empty /home/miget/.ssh/authorized_keys. Supply your public key by mounting a file when launching the container:

docker run --rm -d \
  --name miget-ubuntu-dockerd \
  --privileged \
  -p 2222:22 \
  -v $(pwd)/authorized_keys:/home/miget/.ssh/authorized_keys:ro \
  miget/container-os:latest

Permissions on the directory (700) and file (600) are enforced by the image. Connect using:

ssh -p 2222 miget@localhost

⁠Privileged Environment Requirements

All images are intended to run with full privileges. This matches Miget's MicroVM execution model and avoids brittle rootless/container hacks. When running under Kubernetes or Docker, ensure the pod or container is privileged; the workflows expect access to /dev/fuse, iptables, and kernel features commonly restricted in non-privileged contexts.

⁠Contributing

See DEVELOPMENT.md for contributor workflow details, including local development setup, manifest updates, validation, and publishing pipelines.

⁠License

Copyright © 2025 Miget⁠

Licensed under the Apache License, Version 2.0. See LICENSE⁠ for details.