sig-id

sig-id builds Nucleus, an extremely lightweight, security-hardened, declarative container runtime for Linux targeting AI agent sandboxes and production NixOS services. The project is written in Rust and published as open source under MIT/Apache-2.0 dual license. Nucleus integrates deeply with the Nix ecosystem, providing first-class NixOS module support and reproducible rootfs builds. The organization uses formal verification via TLA+ and the Apalache model checker across subsystems.