Install a rootless container engine in 2 minutes: one binary, no daemon, no sudo

boxr is an OCI container engine written in Rust. The whole thing is one static
binary: no daemon to configure, no root privileges needed, no package repo to add.
You download one file, verify it, put it on your PATH, and you are running
containers. This is the companion post to the install video, same steps, in text
form so you can copy the commands.

One honest note up front: boxr is beta software in the 0.1.x series. The core
workflow is solid, but expect rough edges. Rootless operation needs Linux user
namespaces, so this walkthrough is Linux-focused.

Step 1: download

Go to the releases page (https://github.com/kchaitanya863/boxr/releases), find the
latest release, and download the archive for your platform. On 64-bit Linux that
file is called boxr-linux-x86_64.tar.gz. There are also ARM, macOS, and Windows
builds, plus Debian and RPM packages if you prefer those. Every file ships with a
matching checksum file. Download that too.

Step 2: verify

This matters. A checksum proves the file you downloaded is byte-for-byte
identical to what the release pipeline published:

sha256sum -c boxr-linux-x86_64.tar.gz.sha256

You want to see the word OK. If you do, continue.

Step 3: extract

Untar the archive and look inside. The file that matters is bin/boxr: a single
static binary. That binary is the entire container engine. There is also an
install script and shell completions, but nothing else to install.

tar xzf boxr-linux-x86_64.tar.gz
ls bin/

Step 4: put it on your PATH

Copy the binary somewhere your shell already searches. If you administer the
machine, /usr/local/bin is the classic choice. Otherwise ~/.local/bin works
perfectly, and boxr never needs root anyway:

cp bin/boxr ~/.local/bin/
chmod +x ~/.local/bin/boxr

If you used the home directory option, make sure it is on your PATH:

export PATH="$HOME/.local/bin:$PATH"

(Add that line to your shell config so it sticks.)

Step 5: confirm

boxr --version
boxr images

The first prints the version. The second shows an empty table with just the header
row, which is expected: you have not pulled any images yet. Your engine is ready.

Worth knowing

boxr keeps all of its state inside your home directory, in ~/.boxr, so
uninstalling is just deleting the binary and that folder. Upgrading is the same
two-minute process: download the new release, verify it, replace the binary. And
because the binary is static, it runs on basically any Linux distribution with no
dependency surprises.

What is actually different here

With Docker, your CLI talks to a root-owned daemon that does the privileged work.
boxr has no daemon. The binary has no setuid bit, nothing of boxr keeps running
after your command finishes, and all state lives in your home directory. Root
inside the container maps to your unprivileged user on the host through Linux
user namespaces, so a container escape hands over your user account, not host
root. That is the whole security argument in one paragraph.

Next up

Article 2 walks through the daily workflow: pull, run, ps, logs, stop, rm, rmi,
all through the one binary, recorded live. Article 3 compares the Docker, Podman,
and boxr architectures and shares our startup benchmark with every caveat on the
table (spoiler: boxr 134 ms vs Podman 217 ms median, 20 warm runs each, and yes,
we disclose that both ran as root in the test VM).

If rootless-first resonates with you, try the binary and open an issue when
something breaks: https://github.com/kchaitanya863/boxr. That feedback is the
fastest way to make the engine better.