Download
Gramine is a lightweight library-operating system (Library OS) designed to run unmodified Linux applications with minimal dependencies on the host OS, and to offer enhanced isolation and portability. It was formerly known as Graphene, but the project renamed to Gramine to avoid naming conflicts and to reflect its broader ambition beyond the original research prototype. The idea is that instead of running a full guest OS in a VM, you embed your application inside Gramine, which handles the system-call interface, process and thread management, file system, and network abstractions — everything the application expects — but strips out the overhead and complexity of a full OS stack. One particularly strong use-case is confidential computing: Gramine supports Intel® SGX enclaves, allowing applications to run inside hardware-protected memory regions even while using standard Linux binaries with minimal porting effort.
Features
- Runs unmodified Linux application binaries in a minimal library OS (Library OS) rather than requiring full guest OS overhead
- Supports Intel® SGX enclaves for confidential computing, enabling hardware-based memory and execution protection
- Manifest file configuration that defines environment, file system layout, attestation settings, and isolation policies
- Multi-process and multi-thread support (fork, exec, signals, IPC) in the library OS environment
- Integration with container workflows (via Gramine Shielded Containers) so traditional Docker/OCI images can target secure/isolated runtime
- Designed for portability and minimal host dependencies, enabling easier “lift and shift” of workloads from bare metal, cloud or edge environments into more isolated execution contexts
Project Samples
