boks

boks is a secure, containerized tool manager. It runs any CLI tool from an OCI container image as if it were a native binary — with network and filesystem access locked down by default.

boks runs on Linux and macOS. Windows is supported via WSL2.

      .-.         
 .+BBBBBBBBB+.    
BBBB+    .BBBBB     boks.sh v0.1
BB -BBBBBBBBBBB     ■ Podman detected
BB    -BBBBBBBB     ■ Docker not found
BB    -BBBBBBBB     ■ container not found
BB    -BBBBBBBB   
.+BBBBBBBBB+.     
     -BBB-        

Usage: boks [OPTIONS] [TOOL] [ARGS]...

Arguments:
  [TOOL]     Tool name or image to execute
  [ARGS]...  Arguments passed to the tool

Options:
  -s, --search <QUERY>       Search the tool index
      --info <TOOL>          Show a tool's synopsis and image metadata
  -l, --list                 List installed shims
      --clean                Remove cached environment images
      --update               Refresh the global tool index
  -i, --install              Install a shim for TOOL
      --non-interactive      Disable TTY (auto-set in CI)
  -e, --env <ARG>            Build environment + compose tools (comma-separated)
      --cap <LIST>           Capabilities: net,rw,ro,nomount,rwimg,browser,clipboard,pid,gpu,nonet,nobrowser,noclipboard
      --privileged           Run without capability restrictions
  -p, --port <SPEC>          Publish a container port to the host
      --platform <PLATFORM>  Override container platform
      --runtime <RUNTIME>    Override container runtime
      --k8s                  Run in a Kubernetes pod
  -n, --namespace <NS>       Kubernetes namespace
      --node <NODE>          Kubernetes node
  -h, --help                 Print help

What boks does

When you run boks jq --version, boks:

  1. Looks up jq in the tool index to find its container image
  2. Pulls the image if not cached locally
  3. Mounts your current directory as /boks/workdir (read-only)
  4. Runs jq inside an ephemeral container with no network access
  5. Exits cleanly — no container left behind

The tool behaves exactly as if it were installed natively, but it cannot touch anything outside your working directory, and it cannot reach the network unless you say so.

Reading the docs