Build from source and run your first container

ZViz ships as source. This guide takes you from a clean machine to a running, sandboxed container.

Prerequisites

• A Linux host on kernel ≥ 5.13 (for Landlock) with cgroups v2 enabled.
• Zig 0.15.0+ to build from source.

1. Install Zig

Download Zig 0.15.0 or newer from ziglang.org and put it on your PATH:

zig version   # 0.15.0 or newer

2. Clone and build

git clone https://github.com/Skelf-Research/zviz.git
cd zviz
zig build -Doptimize=ReleaseSafe

The binary is written to zig-out/bin/zviz.

3. Extract an OCI rootfs

Any OCI rootfs works. The quickest way is to export one from an existing image:

mkdir -p ~/bundle/rootfs
docker create --name x redis:alpine
docker export x | tar -C ~/bundle/rootfs -xf -
docker rm x

4. Run it

Add a minimal config.json to ~/bundle, then:

./zig-out/bin/zviz run my-container ~/bundle

ZViz sets up namespaces, drops all 41 capabilities, applies Landlock, loads the seccomp filter, applies cgroups v2 limits, and exec-replaces into PID 1.

Next steps

• Run an untrusted OCI image with a stricter profile.
• Understand what the policy actually allows.
• Read how the enforcement stack fits together.