A container runtime implemented in Go from scratch using only the standard library. Isolates processes with Linux namespaces, gives each container its own overlayfs root, and caps CPU/memory/PIDs with cgroups v2. Adds container networking with a private IP and NAT to the internet, image pulls from Docker Hub, and a CLI.