Lightweight container runtime

No daemon. No Docker.
Just containers.

cardinal is a single ~5 MB static Go binary that runs OCI images with Linux namespaces, a bridge network, cluster orchestration, and serverless functions — no dockerd, no system daemon, nothing to babysit.

Install cardinal Read the docs

Linux · unshare + overlayfs · MIT license

bash — cardinal

$ cardinal run -d -n web -p 8080:80 nginx:alpine ✓ pulled nginx:alpine ✓ container "web" created · 10.0.2.2 ✓ port 8080 → 80 (iptables DNAT) $ curl -s http://localhost:8080 HTTP/1.1 200 OK $ cardinal ps

~5MB

single static binary

daemons to run

one-command blueprints

zero runtime dependencies

Why cardinal

Everything a container runtime should be, nothing it shouldn't.

cardinal is built for the command line: fast, predictable, and small enough to live on any VPS. It gives you the containers you need without the machinery you don't.

binary

No daemon

A single static binary talks to the kernel directly. No dockerd, no background service, nothing listening when you aren't using it.

oci

OCI images

Run any OCI or Docker image. Pull from Docker Hub, verify digests offline, and build new images with cardinal commit.

net

Bridge networking

Every container gets an IP on the cardinal0 bridge (10.0.2.0/24) with port mapping via iptables DNAT — no restart to change ports.

cluster

Cluster orchestration

Join nodes into a cluster with service scaling, rolling updates, and DNS-based service discovery — still in the same binary.

faas

FaaS / serverless

Deploy images as serverless functions with warm replicas, auto-scaling, and scale-to-zero after an idle window.

templates

One-command blueprints

A registry of 27 ready-to-deploy templates — WordPress, Minecraft, PostgreSQL and more — installed with a single cardinal blueprint install.

security

Hardened by default

Built-in seccomp profile (blocks 30+ syscalls), AppArmor support, read-only device mounts, network segmentation (--isolated), AES-256-GCM encrypted backups, and audit logging.

compose

Compose & recover

Declare multi-container stacks in cardinal.toml and start them with cardinal up. Containers with --restart always recover automatically on boot via a systemd supervisor.

How it works

One binary. Kernel namespaces. A bridge called cardinal0.

A container is just an image plus a writable overlay, pinned into isolated namespaces and wired to a private network.

H cardinal0 10.0.2.1/24 · host gateway Host

A container "web" eth0 · 10.0.2.2 nginx:alpine

B container "db" eth0 · 10.0.2.3 postgres:16

Each cardinal run launches an unshare process with PID, mount, network, UTS and IPC namespaces, pivots into an overlay rootfs, then execs your command. Containers reach each other across the bridge and reach you through DNAT port rules.

cardinal0 · routing

# A → host          ping 10.0.2.1      (gateway)
# host → A          ping 10.0.2.2      (host route)
# A → B             ping 10.0.2.3      (via bridge)
# A → B's port      curl 10.0.2.1:8080 (DNAT → B:80)

Philosophy

Design principles, not feature checklists.

cardinal is built around six ideas. They explain why there is no daemon, why the binary is 5 MB, and why security is on before you ask for it.

What isn't running can't break.

No daemon, no hidden process: cardinal exists only while you are using it. Idle means zero processes, zero ports, zero attack surface.

Size is a feature.

One ~5 MB static binary. Less code, fewer bugs, less memory, faster starts — small enough to live on any VPS.

The kernel is the API.

cardinal talks to the kernel directly — unshare, pivot_root, cgroups, iptables. No middleware layer inventing its own reality: what you see is what happens.

Persistence is a choice.

Containers die cleanly. Auto-restart (--restart always) is an explicit decision, not a hidden background service. The supervisor is opt-in, not on by default.

Secure by default, not after the incident.

Seccomp blocking 30+ syscalls, AppArmor, --isolated networking — on out of the box. “Safe if you configure it” is not the philosophy.

Capabilities are features, not products.

Clusters, FaaS, encrypted backups, audit logging — all in the same binary. No second product to install when you outgrow one container.

Read the full philosophy →

Comparison

Docker, minus the daemon.

cardinal keeps the parts of the container model that matter and drops the machinery that weighs it down.

Feature	cardinal	Docker
Daemon	None	dockerd required
Binary size	~5 MB	~100+ MB
Image format	OCI / Docker V2	OCI / Docker V2
Bridge network	cardinal0 · 10.0.2.0/24	docker0
Auto-start	systemd supervisor	systemd dockerd
Compose	cardinal.toml	docker-compose
Cluster orchestration	Built in	Swarm
FaaS / serverless	Built in	—
Seccomp / AppArmor	Default + custom	Default + custom
Backup encryption	AES-256-GCM	—
Audit logging	Built in	auditd integration

See the full comparison — cardinal vs Docker vs Podman →

Blueprints

Deploy real apps in one command.

A curated registry of templates for databases, game servers, web apps, and more. Install pulls the image, resolves ports, and prompts for the env vars you care about.

Databases

PostgreSQL, MySQL, Redis, and friends with persistent storage.

Games

Minecraft, Valheim, Palworld, and more dedicated servers.

Web

Nginx, Caddy, WordPress, Ghost, and app templates.

Monitoring

Grafana and Uptime Kuma for observability.

Network

AdGuard Home and WireGuard for your network edge.

Voice

TeamSpeak 3 voice server.

Storage

Self-hosted cloud storage and collaboration.

Media

Jellyfin media streaming.

Browse all 27 blueprints →

Get started

Install in one line.

Native packages for Debian/Ubuntu, Fedora/RHEL, Arch, Alpine, NixOS, Snap and AppImage — or just grab the static binary. Full instructions are in the docs.

install · Universal installer

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/install.sh | sudo bash

Auto-detects your distro and package manager (apt / dnf / pacman / apk), installs dependencies, and verifies the SHA-256 checksum.

install · APT repository

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/scripts/install-apt.sh | sudo bash
sudo apt update && sudo apt install cardinal

Official signed repository — receives updates through apt like any other package.

install · dnf + binary

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/install.sh | sudo bash

The universal installer detects dnf/yum and pulls the matching dependencies.

install · pacman + binary

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/install.sh | sudo bash

The universal installer detects pacman (and Arch-based distros like Manjaro) and pulls iptables-nft + dependencies.

install · apk + binary

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/install.sh | sudo bash

The universal installer detects apk and installs the binary with its dependencies.

install · Linux VM or VPS

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/install.sh | sudo bash

cardinal is a Linux runtime (namespaces + overlayfs). Run it on a Linux VPS, VM, or inside WSL — the same one-line installer works there.

install · WSL2 (Ubuntu)

curl -fsSL https://raw.githubusercontent.com/animesao/cardinal/main/scripts/install-apt.sh | sudo bash
sudo apt update && sudo apt install cardinal

Install WSL2 with an Ubuntu distribution first, then run the APT recipe inside the Ubuntu terminal.

first containers

cardinal pull nginx:alpine
cardinal run -d -n web -p 8080:80 nginx:alpine
cardinal ps
curl http://localhost:8080

Community

Build with the cardinal community.

Join the official Discord to ask questions, share blueprints, follow releases, and talk with people building on cardinal.

Join Discord

Put your VPS to work.

No daemon to install, no compose files to fight. Read the docs and run your first container in under a minute.

Read the documentation

No daemon. No Docker. Just containers.