~3 MB. No daemon.
7 isolation layers.

One binary.
No installer. No service.

Drop the binary anywhere on PATH and run. No background service, no systemd unit, no privileged group required for --rootless.

# 1. Download the binary, signature, checksum file, and public key
curl -fsSL https://hull.getmentat.run/releases/hull-x86_64 -o hull
curl -fsSL https://hull.getmentat.run/releases/hull-x86_64.minisig -o hull-x86_64.minisig
curl -fsSL https://hull.getmentat.run/releases/SHA256SUMS -o SHA256SUMS

# 2. Compare SHA256
sha256sum -c SHA256SUMS --ignore-missing
# hull-x86_64: OK

# 3. Verify the minisign signature against the project public key
minisign -Vm hull -P RWQLMHs2c5iiqJf3r7KPdMKdIOgDalrXqzEKI7ijt0DROB2ywop8pbxr
# Signature and comment signature verified

# Only after both checks pass:
chmod +x hull && sudo mv hull /usr/local/bin/

Real apps, default profile.
No seccomp loosening required.

Each row was validated end-to-end on a clean GCP VM (Ubuntu 24.04) without Mentat, without Docker: download the binary, hull pull, hull run, hit the service, response received. No syscalls disabled, no privileged container — all 7 isolation layers active.

From zero to running
in three commands.

curl -fsSL https://hull.getmentat.run/install.sh | sh

# or manually:
curl -fsSL https://hull.getmentat.run/releases/hull-x86_64 -o /usr/local/bin/hull && chmod +x /usr/local/bin/hull
hull version

{
  "name": "myapp",
  "rootfs": "/var/lib/hull/rootfs/myapp",
  "argv": ["/app/server", "--port", "8080"],
  "env": ["PORT=8080", "NODE_ENV=production"],
  "profile": "default",
  "network": "bridge",
  "hostname": "myapp",
  "limits": { "memory_mb": 256, "cpu": 1.0, "pids": 128 }
}

hull run myapp.json

hull ps
# NAME     PID       UPTIME      ARGV
# myapp    42351     12          /app/server

hull exec myapp /bin/hostname
# myapp

hull inspect myapp
# Container: myapp
#   status:    running
#   pid:       42351
#   Cgroup:    memory 48/256M, cpu 1.0, pids 3/128
#   Namespaces: pid:[4026560304] net:[4026560239] mnt:[...] ...

hull stop myapp

Ten commands.
Zero configuration files.

Seven layers.
Each independent.

Failure of one layer does not disable the others. A workload that escapes seccomp still hits Landlock. A workload that bypasses Landlock still sees an isolated PID tree and empty /proc.

Curated syscall allowlists
per workload type.

Blocked in all profiles: ptrace, process_vm_readv, bpf, add_key/keyctl, userfaultfd, kexec_load, init_module. x86_64 and aarch64 supported.

Pull. Run.
No Docker required.

Hull images are flat rootfs tarballs stored in an S3-compatible backend (OxideStore). No layers, no manifest lists, no platform indices. One tarball per image, one command to pull.

# Pull an image from the hull registry
hull pull hull.getmentat.run/node:22-slim
hull pull hull.getmentat.run/postgres:16
hull pull hull.getmentat.run/redis:7

# Run it
hull run --manifest <(cat <<EOF
{
  "name": "mydb",
  "rootfs": "/var/lib/hull/rootfs/postgres-16",
  "argv": ["postgres", "-D", "/var/lib/postgresql/data"],
  "profile": "default",
  "network": "bridge",
  "limits": { "memory_mb": 512 }
}
EOF
)

Three network modes.

$ nsenter -t <pid> -n ip -br addr
lo               UNKNOWN        127.0.0.1/8
eth0@if36548     UP             10.88.0.2/24

$ nsenter -t <pid> -n ping -c 3 8.8.8.8
3 packets transmitted, 3 received, 0% packet loss
rtt min/avg/max = 0.256/0.389/0.523 ms

Hull means
two things in English.

And both fit what the runtime does.

Hull vs Docker vs runc

One JSON file.
Three required fields.