Pullrun: Run OCI Images as Containers or Firecracker MicroVMs
You can now run same OCI images as containers or Firecracker microVMs
I built Pullrun to collapse fragmented infrastructure into a single 12 MB binary. This runtime lets you execute the same OCI image as a Linux container, a Firecracker microVM, or an Apple Silicon VM without separate build steps. By replacing traditional overlayfs with a content-addressed DAG store and enabling peer-to-peer image sync, we eliminate the need for heavy daemons while delivering faster startup times and stronger isolation.
Docker's overlayfs store is a filesystem overlay — CVEs in overlayfs can let a container escape to the host. Pullrun's content-addressed DAG store stores layers as-is, verified by content hash. No overlayfs, no escape.