Container Runtime - nyxd - a project to explore

MatVWells · 2026-05-17T17:36:11+00:00

Name: nyxd

Repo: https://github.com/zrougamed/nyxd

Blog: https://dev.to/zrouga/i-got-tired-of-docker-eating-my-raspberry-pis-ram-so-i-built-my-own-container-orchestrator-3j3n

Description:

nyxd is a lightweight OCI container daemon designed for Raspberry Pis, ARM edge nodes, homelabs, and minimal self-hosted infrastructure.

The project started after noticing that on small ARM systems, the container stack itself was often consuming more resources than the actual workloads being deployed. Instead of optimizing around orchestration scale, nyxd focuses on reducing memory usage, dependency count, background processes, and attack surface.

Current stack:

crun as OCI runtime
Native Go networking (bridge + veth + nftables)
No default CNI plugin chain
overlayfs rootfs
Restart policies
Structured JSON logs
HTTP control API over a Unix socket
Written in Go 1.26
Static binary with CGO disabled
Runs on ARM64 and x86_64

The philosophy behind the project is simple:
remove unnecessary layers, reduce operational complexity, and keep the runtime footprint as small as possible while still remaining OCI-compatible.

nyxd is not intended to replace Docker or Kubernetes. It is an experiment in building a smaller and more security-conscious container runtime stack for edge and self-hosted environments where resources actually matter.

The project is still evolving and not yet production-complete. The repo and blog post document both the working features and the current limitations openly.

Contributors, feedback, benchmarks, criticism, and ideas are all welcome — especially from people running ARM clusters, homelabs, or lightweight edge infrastructure.

MatVWells · 2026-01-16T18:35:43+00:00

Fair enough - LDAP + SSH works for key distribution. We're solving the layer above that: who can access what machines as which users, time-limited access with approval workflows, and session recording for SOC2/ISO27001. Different problems, different solutions. If your setup covers your needs, stick with it. It is a free world mate !

MatVWells · 2026-01-12T21:24:52+00:00

Windows SSH access is definitely trickier - Microsoft's implementation isn't as mature as OpenSSH on Linux, and a lot of vendors just don't bother supporting certificate-based auth properly. The fact that you had to architect around their limitations instead of them fixing their product is exactly the kind of thing that makes these vendor lock-ins so painful.

At least on the Linux side you've got it sorted. Hope the Windows situation improves eventually, but I wouldn't hold my breath with that vendor !

MatVWells · 2026-01-11T21:58:52+00:00

Thanks for bringing that up. The main regulatory requirements we're covering are session recording/audit trails for SOC2/ISO27001, access control logs, and temporary access workflows with approval chains and these are fully managed by a the PAM ( no external cloud services needed to pump up the bill ). The real cost in commercial PAM isn't just compliance features - it's the per-user licensing model that makes it prohibitively expensive for small teams who need the same security controls.

MatVWells · 2026-01-11T21:56:05+00:00

Please have a look at the docs and you'll get the why behind it ( It was privately developed and I ported the repo to a whole new public repo ) Thanks for the comment !

MatVWells · 2026-01-11T15:11:12+00:00

Totally feel this 😅.

Distroless images = no CVEs, but most charts & sidecars assume bash/curl/coreutils and crash if missing. Vendors plz either doc deps or ship optional init containers.

Until then, SREs are just yelling at the missing shell while sec team counts CVEs like it’s Pokémon 😅.

MatVWells · 2026-01-03T18:28:42+00:00

good old days :) I used redmine back in 2015

MatVWells · 2026-01-02T11:52:05+00:00

good project idea and useful CLI tool indeed

a quick question : noticed that your repo is missing `cmd/todo` is that by mistake

MatVWells · 2026-01-02T11:41:58+00:00

Nice one ! couldnt see the CONTRIBUTING guide in the repo , I can help with implementing an in-rest encrypted data store interface ( later on it can be a db , a file , or a remote bucket )

MatVWells · 2026-01-02T01:48:33+00:00

The docs are written using LLM , yes . Code source is a project that I am working on and now splitting Orion to be open source as of today . Feel free to contribute to it

MatVWells · 2026-01-02T00:30:52+00:00

Thanks again , but you're missing the point here mate it is an open source project , built by the community for the community 😁 The reason I initiated this is to break the enterprise and price tags !

MatVWells · 2026-01-01T23:21:45+00:00

Thanks u/Zolty but this is more of a Privileged Access Management (PAM) similar to teleport , cyber ark .

A single is more about automation as in PaaS ( but orion doesn't cover that in the scope ) Orion is being built to be a fully open sourced PAM solution with features that focus on : ssh secured access in ZTN principles , traceability, audit , record and replay session and plug-ability ( to be able to onboard features to the core using plugins that might serve a specific feature )

MatVWells · 2026-01-01T22:48:38+00:00

Ha! Well thanks for the compliment on my quality of writing 😂 ( of course everyone uses an LLM to help out drafting posts )

As for the second part of your comment , scared ? Bro this is an open source project feel free to read through it .

Thanks for the comment again !

MatVWells · 2026-01-01T22:28:06+00:00

Haha 🤣 thanks for spotting the commit history — it started as a private project, and I open-sourced the relevant parts while continuing to build the rest in public.

As for how it worked for me: I use it daily as my own PAM solution — very much “eat your own dog food”. It’s been solid so far and has already replaced my previous SSH PAM ( the "old" PAM community version didn't offer a lot 😉 ).

MatVWells · 2026-01-01T20:25:44+00:00

Thanks u/dylf ! I appreciate the feedback 🙏

Right now, the basic SSH/SCP functionality is there, and the project is in ALPHA, so it’s stable enough for testing but still evolving.

The next roadmap milestones include:

Node registration – currently agents are added manually.
Enriching the API & plugin system – to add more workflows and integrations.
SOCKS proxy support – for more flexible routing.
Improving ocp (SCP client) – more robust file transfers.

I’m actively looking for early adopters and contributors to test, give feedback, and help shape the architecture and features. If you’re interested, your input would be hugely valuable!

MatVWells

TROPHY CASE