Nishi Family › Compare › Containers and Orchestration
Nishi vs the Field
Containers and Orchestration — mechanically measured, liar-killed, sovereign.
The sovereign daemonless Nishi Container Host vs Docker Desktop and Portainer and Podman and Kubernetes -- runtime measured live on the RTX 5080 Windows host that runs Elder AI image-gen off Docker
How this is scored. Every Nishi cell is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). Competitor cells record documented capability presence. Best=leads this axis, Yes=present, Part=partial, No=absent. This is capability presence, not depth or scale: the majors lead on index size and neural ranking. Nishi's genuine exceeds are the sovereignty / neutrality / determinism axes.
Feature matrix
| Capability | Nishi | Docker Desktop | Portainer | Podman | Kubernetes | Notes |
|---|---|---|---|---|---|---|
| Process isolation primitive | Yes | Yes | Part | Yes | Yes | Linux stack isolates via namespaces plus cgroups and K8s pods; Portainer delegates to the engine it manages; Nishi governs natively via Windows Job Objects |
| Lifecycle governance run-wait-reap | Yes | Yes | Yes | Yes | Yes | Nishi container PE creates the Job then CreateProcessW then Wait then ExitCode then clean reap -- proven live governing the CUDA engine |
| Declarative service spec | Yes | Yes | Part | Yes | Best | K8s declarative YAML is the reference; Compose files yes; Portainer edits stacks over an engine; Nishi ContainerSpec drives the emitter from data |
| Build runnable artifact from spec | Yes | Best | Part | Yes | No | docker build with BuildKit is Best in class; podman build yes; K8s delegates builds; Nishi stamps the spec onto a proven 2560-byte governance PE template |
| Multi-service orchestration dependency order | Yes | Yes | Part | Part | Best | K8s is the orchestration reference; compose depends_on yes; podman kube partial; Nishi topological planner rejects cycles and missing deps by construction |
| Health probe plus auto-restart supervision | Yes | Yes | Yes | Part | Best | K8s liveness and readiness probes are Best; Docker healthcheck and restart policies; Nishi hostctl supervise runs live in production (PID-liveness plus SERVING probe HUNG-aware plus crash-loop backoff) AND the Windows container PE now self-restarts its governed child -- respawn proven live with 3 distinct child PIDs, hand-emitted in a 2560-byte PE |
| Never-brick deploy health-gated promote auto-rollback | Yes | No | Part | No | Best | K8s rolling update can undo; plain Docker and Podman have none; Portainer redeploys without health-gated auto-rollback; Nishi /api/deploy watchdog rolls back BY CONSTRUCTION |
| One-command source to live pipeline | Yes | Part | Best | Part | Part | Portainer GitOps stack redeploy is its strength; Nishi nx_ship packs then uploads then builds on target over sovereign TLS in one command |
| Live fleet inventory API | Yes | Yes | Best | Yes | Best | Portainer UI and kubectl get are Best; docker ps yes; Nishi GET /api/services serves the live multi-service inventory over the sovereign mgmt API |
| Event stream monitoring hooks | Yes | Yes | Yes | Yes | Best | docker events yes; K8s watch API Best; Nishi GET /api/events serves text/event-stream to EventSource clients |
| Container fleet management web UI | Yes | Part | Best | Part | Best | Portainer is the reference container UI but needs a root-equivalent engine socket; Nishi Sovereign Fleet at /health is LIVE behind the operator login -- per-service cards with state and crash-loop and port-squatter warnings, allowlisted restart actions, deploy status and an SSE live tick, rendered by the engine itself |
| GPU workloads in containers | Yes | Part | Part | Yes | Yes | Docker Desktop routes GPU through the WSL2 VM; podman CDI and K8s device plugins are Linux-native; the Nishi-governed child owns the RTX 5080 natively -- 10.9GB VRAM Z-Image generation proven live |
| Rootless least-privilege operation | Yes | Part | No | Best | Part | Podman pioneered rootless and is Best; Docker rootless mode is non-default; Portainer needs the engine socket which is root-equivalent; Nishi runs as the plain user with zero daemon and zero admin |
| Resource limit quotas | Yes | Yes | Yes | Yes | Best | cgroups give full cpu-mem-io quotas and K8s requests-limits are Best; Nishi Job-Object limits are basic today -- quota depth is a named gap |
| Syscall-filter sandboxing depth | No | Yes | Yes | Yes | Best | seccomp and AppArmor ship default on the Linux stack and gVisor or Kata harden further; Nishi has Job-Object boundaries only -- no syscall filter yet |
| Image registry and distribution | Yes | Best | Part | Best | Yes | Docker Hub plus OCI distribution is the ecosystem Best and Podman is full OCI; Nishi now has a sovereign content-addressed registry -- put and get by name where the SHA-256 digest IS the address (dedup plus integrity by construction), a tampered blob is refused on pull; proven on real container PEs (byte-identical round-trip), P2P distribution over the live torrent plane is the next rung |
| EXCEED measured: idle overhead 0 MB 0 processes | Best | No | No | No | No | Measured live on this host: Nishi 0 MB and 0 procs idle vs Docker Desktop 2774 MB and 6 procs; a K8s control plane is heavier still; verdicts computed by the liar-killed judge nx_container_bench |
| EXCEED measured: runtime install 2560 bytes | Best | No | No | No | No | The whole Nishi container runtime is a 2560-byte PE vs Docker Desktop 4.11 GB install; Portainer adds hundreds of MB on top of an engine it requires |
| EXCEED measured: cold start 976 ms with zero VM tax | Best | No | No | No | No | First governed process 976 ms vs Docker 1660 ms and isolation VM tax 0 vs 2225 MB -- no WSL2 or HyperV VM under the runtime on Windows |
| EXCEED sovereign: whole runtime auditable bits-up | Best | No | No | No | No | The entire runtime emitter orchestrator and judge are readable sovereign source with zero third-party dependencies; incumbents are millions of lines over kernel plumbing no operator can audit |
coverage 950/1000EXCEEDS 4PRESENT 15ABSENT 1
Honest verdict. Nishi has broad, sovereign search-engine presence — a real organ behind every core ranking and crawl axis, built bits-up in one language. It is not yet a scale or neural-ranking rival: the majors lead on index size (billions to trillions vs a Common-Crawl-seeded slice) and trained rerankers. Nishi's genuine exceeds are structural — owning the whole stack, neutrality by construction, and a zero-JS integer-deterministic result page. The climb is a bigger index and a trained reranker.
Generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/containers.matrix — every Nishi cell verified against real organ source on disk. Zero JS, zero trackers.