| Method| Description| Limitations|

| ----------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

|[Sysbox container runtime](#sysbox-container-runtime)| Install thesysbox runtime on your Kubernetes nodes for secure docker-in-docker and systemd-in-docker. Works with GKE, EKS, AKS.| Requires[compatible nodes](https://github.com/nestybox/sysbox#host-requirements).[Limitations](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/limitations.md)|

|[Envbox](#envbox)| A container image with all the packages necessary to run an innersysbox container. Removes the need to setup sysbox-runc on your nodes. Works with GKE, EKS, AKS.| Requires running the outer container as privileged (the inner container that acts as the workspace is locked down). Requires compatible[nodes](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md#sysbox-distro-compatibility).|

|[Rootless Podman](#rootless-podman)| Runpodman inside Coder workspaces. Does not require a custom runtime or privileged containers. Works with GKE, EKS, AKS, RKE, OpenShift| Requires smarter-device-manager for FUSE mounts.[See all](https://github.com/containers/podman/blob/main/rootless.md#shortcomings-of-rootless-podman)|

|[Privileged docker sidecar](#privileged-sidecar-container)| Rundocker as a privileged sidecar container.| Requires a privileged container. Workspaces can break out to root on the host machine.|

|[Sysbox container runtime](#sysbox-container-runtime)| Install theSysbox runtime on your Kubernetes nodesor Docker host(s)for secure docker-in-docker and systemd-in-docker. Works with GKE, EKS, AKS, Docker.| Requires[compatible nodes](https://github.com/nestybox/sysbox#host-requirements).[Limitations](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/limitations.md)|

|[Envbox](#envbox)| A container image with all the packages necessary to run an innerSysbox container. Removes the need to setup sysbox-runc on your nodes. Works with GKE, EKS, AKS.| Requires running the outer container as privileged (the inner container that acts as the workspace is locked down). Requires compatible[nodes](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md#sysbox-distro-compatibility).|

|[Rootless Podman](#rootless-podman)| RunPodman inside Coder workspaces. Does not require a custom runtime or privileged containers. Works with GKE, EKS, AKS, RKE, OpenShift| Requires smarter-device-manager for FUSE mounts.[See all](https://github.com/containers/podman/blob/main/rootless.md#shortcomings-of-rootless-podman)|

|[Privileged docker sidecar](#privileged-sidecar-container)| RunDocker as a privileged sidecar container.| Requires a privileged container. Workspaces can break out to root on the host machine.|