What exactly is cardinal? ↓
cardinal is a lightweight container runtime: a single ~5 MB static Go binary that runs OCI images using Linux namespaces and overlayfs. There is no daemon — the binary talks to the kernel directly when you invoke it, and nothing runs in the background unless you ask for it.
How is cardinal different from Docker? ↓
Docker ships a ~100 MB client plus a always-running daemon (dockerd). cardinal is one ~5 MB binary with no daemon at all. It also builds in things Docker only gets from separate products: cluster orchestration, FaaS/serverless, encrypted backups, and audit logging. Containers with --restart always are kept alive by a small systemd supervisor instead of a daemon.
Can cardinal run my existing Docker images? ↓
Yes. cardinal speaks the OCI/Docker V2 image format, pulls from Docker Hub and any registry, and understands standard docker-compose.yaml files as well as its native cardinal.toml. There is also cardinal serve, a Docker-compatible HTTP API for clients like Portainer or VS Code Dev Containers.
Does cardinal support Dockerfiles? ↓
Yes — cardinal build handles the common instruction set (FROM, RUN, COPY, WORKDIR, ENV, CMD, HEALTHCHECK, multi-stage builds with COPY --from=, and more), and cardinal commit snapshots a running container into a new image.
Which operating systems are supported? ↓
cardinal is a Linux runtime — it needs kernel namespaces, overlayfs and cgroups v2. Packages exist for Debian/Ubuntu (APT), Fedora/RHEL (dnf), Arch, Alpine, openSUSE, NixOS, Snap and AppImage, plus a universal installer that auto-detects your distro. On macOS or Windows, run it in a Linux VM or WSL2.
Do I need to be root? ↓
Root is the normal path (the installer enables IP forwarding and configures the firewall for you). Rootless mode is also supported on systems with newuidmap/newgidmap, using userspace networking.
How does cardinal keep my containers running? ↓
Start a container with --restart always or --restart unless-stopped and cardinal installs a persistent systemd supervisor (cardinal bootstrap --install). After a reboot or crash, the supervisor recreates the overlay, runs unshare, and brings the container back up automatically.
Is cardinal secure by default? ↓
It ships hardened: a default seccomp profile that blocks 30+ dangerous syscalls (mount, ptrace, reboot, bpf, init_module…), an AppArmor profile, read-only rootfs and --no-new-privs options, network isolation with --isolated, AES-256-GCM encrypted backups, and optional audit logging of lifecycle events.
Can I run multi-container stacks? ↓
Yes. Declare containers in cardinal.toml (or a compose YAML) and start the whole stack with cardinal up. depends_on is respected — including service_healthy, which waits for a healthcheck before starting dependents. cardinal down tears the stack down.
How do clusters and serverless work? ↓
Built into the same binary. cardinal cluster init / join connects nodes, cardinal service runs replicated services with rolling updates and DNS-based discovery, and cardinal fn deploy runs images as serverless functions with auto-scaling and scale-to-zero.
What are blueprints? ↓
Blueprints are pre-configured, one-command templates for real apps — WordPress, Minecraft, PostgreSQL, Nextcloud, Jellyfin and more. cardinal blueprint install minecraft-server pulls the image, resolves ports, and prompts for the environment variables you care about.
How do I migrate from Docker? ↓
The mental model is the same: images, containers, ports, volumes, compose. Existing Docker Hub images and compose files keep working, and cardinal serve speaks the Docker API for tooling that expects it. The CLI mirrors docker's flags (-p, -v, -e, --restart…), so muscle memory mostly carries over.
