Pullrun: Run OCI Images as Containers or Firecracker MicroVMs
You can now run same OCI images as containers or Firecracker microVMs
I built Pullrun to collapse fragmented infrastructure into a single 12 MB binary. This runtime lets you execute the same OCI image as a Linux container, a Firecracker microVM, or an Apple Silicon VM without separate build steps. By replacing traditional overlayfs with a content-addressed DAG store and enabling peer-to-peer image sync, we eliminate the need for heavy daemons while delivering faster startup times and stronger isolation.
Docker's overlayfs store is a filesystem overlay — CVEs in overlayfs can let a container escape to the host. Pullrun's content-addressed DAG store stores layers as-is, verified by content hash. No overlayfs, no escape.
- aliasxneo
Is the OP the author of this? Because they are writing responses here that are unquestionably unedited LLM generated responses. The project looks cool, and I'm particularly glad to see a reach for a p2p container registry, but that sort of behavior doesn't lend credibility to something as critical as image infrastructure.
- Izmaki
> Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI.
It is my understanding that Docker Engine adds capabilities (such as network stack) on top of Containerd (which is a project maintained by the same people), and "CRI for Kubernetes" is a Container Runtime Interface which COULD be something other than Containerd but often is just Containerd. So in essence the reason why yet another runtime exists is that we have a runtime for containers (Docker/Containerd, Containerd and, for example, Containerd as the CRI in K8s), a runtime for isolation and a runtime for AI agents.
That seems like an unnecessary argument on its own, which makes me wonder why it's listed as the first argument.
- vaylian
Sweet. I had hoped for someone to make a p2p container registry eventually. There is too much centralization with the current popular registries.