Pullrun: Unified Runtime Runs Same OCI Images as Containers, VMs, and AI Agents
Key Takeaways
- ▸Single OCI image works across containers, VMs, Kubernetes, and AI agents without separate builds or image formats
- ▸Minimal resource footprint (~14 MB CLI + optional daemon) reduces operational overhead compared to traditional container runtimes
- ▸P2P image distribution and content-addressed storage enable zero-copy reads and efficient cluster-wide synchronization
Summary
Pullrun launched a unified runtime that allows a single OCI image to run as a container, Firecracker microVM, Apple Silicon VM, Kubernetes workload, or MCP-based AI agent task. The tool consolidates infrastructure fragmentation by eliminating the need for separate image formats, storage mechanisms, and build steps across different execution environments. Pullrun ships with a minimal footprint (~14 MB CLI + ~6 MB optional daemon), uses content-addressed DAG storage instead of overlayfs, and includes peer-to-peer image distribution for efficient cluster synchronization. It supports Kubernetes CRI, Docker Compose, and includes policy enforcement (Cosign, SBOM validation, seccomp), encrypted secrets, and an MCP server for AI agent integration—all without requiring a daemon in CLI-only mode.
- Built-in support for Kubernetes CRI, Docker Compose, MCP servers, policy enforcement, and encrypted secrets
Editorial Opinion
Pullrun addresses real infrastructure fragmentation—modern teams juggle Docker, containerd, Firecracker, CRI, and now MCP servers for AI agents, each with incompatible image formats and storage layers. By enabling a single OCI image across containers, VMs, and AI systems, Pullrun could meaningfully reduce operational complexity. The P2P distribution and minimal footprint make it compelling for edge and distributed scenarios. However, success depends on deep Kubernetes integration, ecosystem adoption, and whether the single-image model delivers the same performance and stability guarantees as purpose-built tools.
