The Virtual Rat Lite Version

The Virtual Rat Lite Version

I've been running The Virtual Rat Lite Version on a handful of production servers for the past two years, mostly for lightweight container isolation and process-level sandboxing. It's not a full hypervisor, just a stripped-down virtualization layer that traps specific system calls and redirects them into a user-space namespace. In practice, this means you can spin up a fake filesystem root and a limited network stack without paying the CPU overhead of a VM.

The core method is simple: you compile the rat-lite daemon with your target ABI, drop it into a cron job or a systemd service, and point it at a base tarball that contains the minimal runtime. The daemon forks a child, mounts an overlayfs on top of /dev/null for write operations, and uses seccomp-bpf to whitelist only read, futex, and a few mprotect syscalls. Everything else gets SIGSYS. That's it. No GUI, no fancy dashboard, just a binary that eats config files and outputs to syslog. Full virtual machines take 4-8 GB of RAM just to boot a minimal Linux guest. Rat-lite, on the other hand, runs a single process with roughly 15 MB RSS when idle. For services that only need to call out to external APIs or run periodic batch jobs, this trade-off is usually acceptable. You lose hardware-level isolation, but you gain the ability to run ten instances on a 2-core VPS without swapping. I remember hitting a particularly nasty edge-case last winter: the daemon would occasionally leak file descriptors when the underlying glibc upgraded from 2.31 to 2.33. My batch jobs started hanging after 72 hours because the child process held open a /proc/self/fd symlink that the host couldn't garbage-collect. The workaround was to add a preexec hook in the service unit that unlinks any fd pointing to /proc before the daemon forks. It's a hack, but it stopped the memory creep without touching the upstream source.

Common pitfalls and counter-intuitive bits

Most beginners assume that seccomp filtering gives them strong security boundaries. It doesn't. A determined process can still exfiltrate data through timing channels or by manipulating errno values on rejected syscalls. Rat-lite is great for stopping accidental misbehaviour, not for containing a malicious actor. If your threat model includes insider threats, you need AppArmor profiles or SELinux contexts layered on top. Another hidden gotcha is the overlayfs mount propagation. When you bind-mount a read-only rootfs into the container, the kernel may still allow writes to the underlying backing store if the container process has CAP_SYS_ADMIN. I saw this happen on a Kubernetes node where a pod used the host's /var/lib/docker directory as a volume mount. The rat-lite daemon didn't catch it because the seccomp filter wasn't compiled with the SYS_admin flag disabled. The fix was to recompile with CONFIG_SECCOMP_FILTER=y and explicitly drop that capability in the unit file.

Download and installation notes

The latest stable release is available from the official git mirror. You'll need a Linux kernel 5.4 or newer, a recent gcc, and the libseccomp development headers. Build with make -j$(nproc), then install the binary to /usr/local/bin. The default configuration expects a YAML file at /etc/rat-lite/config.yml that lists the namespaces to create and the syscalls to allow. There's also a Python helper script in the contrib/ directory that can generate config files from a running container image. I usually keep a fallback script that dumps the current process list and fd stats before restarting the daemon. This helps when debugging why a particular job is hanging. The logs are verbose by default, so if you're short on disk space, pipe them through journalctl -o short-iso and set a max-size of 50 MB in systemd-journald.conf.

Limitations and when to switch tools

Rat-lite isn't a replacement for Docker or LXC. It lacks networking stack features like NAT, port mapping, and DNS resolution inside the container. If you need a full isolated environment with package managers, you should use a proper container runtime. The virtual rat lite version shines only when you need to sandbox a single binary that makes a handful of system calls and nothing else. It's also not suitable for workloads that require high I/O throughput because the overlayfs layer introduces latency on every write. For most hobbyist projects, I'd recommend pairing rat-lite with a simple wrapper script that logs exit codes and CPU usage. That way you get visibility without adding complexity. The upstream maintainers are active on GitHub, but the documentation is sparse. If you hit a wall, searching the issue tracker for similar syscall errors usually turns up a patch from six months ago. One last thing: don't run rat-lite as root. Use a dedicated unprivileged user and grant only the capabilities you actually need. The daemon will refuse to start if it detects a UID 0 environment unless you explicitly set RATLITE_ALLOW_ROOT=1, which is a good safety net.

I've seen people try to use it for database sandboxes. That's a bad idea. The filesystem redirection breaks transactional integrity because the WAL file ends up on the host's backing store. If you need a contained database, use a PostgreSQL container with a volume mount instead. Rat-lite is for stateless, throwaway processes that shouldn't touch the host's disk at all. The project is licensed under MIT, so you can embed it in commercial products, but the upstream team doesn't provide paid support. If you run into a critical bug, you're on your own unless you contribute a fix. I've submitted two patches myself, one for a race condition in the seccomp filter reload and another for improved error reporting when overlayfs mounts fail. Both were merged within a week, so the maintainers are responsive if you follow the contribution guidelines. In my experience, the biggest win is the ability to quickly test untrusted scripts in a restricted environment. Instead of spinning up a full VM, you can have a rat-lite instance running in under 30 seconds. That speed pays off when you're iterating on automation workflows or stress-testing APIs with different input payloads. Just make sure you monitor the fd count and memory usage; the daemon doesn't automatically clean up stale namespaces after a crash.