Pullrun is a next-generation container runtime designed to unify the execution of OCI images across various environments, including Linux containers, Firecracker microVMs, and Apple Silicon VMs. It employs a content-addressed DAG storage system, eliminating the need for overlayfs and enabling zero-copy reads. Image synchronization is handled peer-to-peer, significantly speeding up distribution within a cluster.

This approach tackles the complexity of modern infrastructure, which often relies on multiple execution engines like Docker, containerd, and Firecracker, each with its own image format and storage model. Pullrun collapses these layers, allowing the same OCI image to run as either a container or a VM without requiring separate build steps or image formats. Key features include a ~14 MB CLI and a ~6 MB runtime daemon, with the option for CLI-only operation.

The runtime also integrates a Kubernetes CRI shim (beta), Docker Compose support, an MCP server for AI agents, and a policy engine. It offers per-VM kernel isolation for enhanced security and rootless operation by default. Installation is streamlined with a single command across platforms. Pullrun's DAG store, verified by content hash, ensures byte-identical storage across nodes, making P2P sync efficient.