Nishi Family › Compare › Containers and Orchestration

Nishi Compare · capabilities, evidence and delivery

Containers and Orchestration

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

The sovereign daemonless Nishi Container Host vs Docker Desktop and Portainer and Podman and Kubernetes -- runtime measured live on the RTX 5080 Windows host that runs Elder AI image-gen off Docker

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The sovereign daemonless container host is real and measured on the RTX 5080 host: Windows Job-Object isolation and lifecycle, a declarative ContainerSpec driving a 2560-byte governance PE, a topological compose planner, live supervision with self-restart, never-brick deploy, one-command ship, fleet inventory API and SSE, the Sovereign Fleet UI, native GPU ownership (10.9GB VRAM image-gen live), rootless zero-admin operation, and a content-addressed registry. Four measured exceeds: 0 MB idle, 2560-byte runtime, 976 ms cold start with zero VM tax, whole runtime auditable bits-up. Named gaps: quota depth, syscall filtering, P2P distribution.

Where we need to go. Isolation the Linux stack takes for granted -- bounded cpu, memory and io per governed child and a syscall filter -- without giving up the zero-overhead exceeds, and distribution of container PEs peer-to-peer over the live torrent plane by digest.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the content-addressed registry (CONTAINERREGISTRYGATE, byte-identical round-trip on real PEs) landed in one leg; estimates are relative to that.
Where we are: 3 open rungs. Runtime and exceeds proven live; depth of isolation and distribution behind the Linux stack. Counts measured at emit below this line.
Cost to bounded children: 1.5 u. CT1 per-spec cpu, working-set and io quotas on the Job before the child starts.
Cost to a syscall filter: 3 u. CT2 the Windows-native equivalent of seccomp for the governed child -- the hardest rung on this board and the one the field ships by default.
Cost to P2P distribution: 1.5 u. CT3 publish-by-digest onto the torrent plane the estate already seeds and announces.

Research bar. Docker and the OCI stack is measured on seccomp default profiles, cgroups quotas, Hub plus OCI distribution. Theirs: the Linux isolation and distribution reference. Ours: CT1 CT2 CT3 measured on this page.

Research bar. Kubernetes is measured on requests and limits per container, liveness probes. Theirs: the orchestration reference. Ours: CT1.

Operator investment 2026-09-10: delegated work containers: REQUESTED / UNFINISHED. Compose existing CT1 resource governance, CR0 artifact identity and nx_swarm_admit/job/beat/coord/pack/place owners into reproducible delegated work: declared workspace/inputs, live resource admission, output/test/provenance receipts, cancellation and checkpoints with explicit capability status. Place heavy work on qualified local/remote/rented resources; NAS coordinates and stores durable results. Exit zero is not accepted work. Public OCI research is comparative evidence, not proof of Windows-native enforcement or checkpoint support. Link gameengine GE61 and Beach GE57; no duplicate service or automatic asset deletion.

Latest recorded release

No valid dated release entry is recorded for this domain.

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

15 of 22 capability source symbols found|1 of them authored stronger-claims|7 open|coverage 681/1000|adoption 6 full / 9 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

evidence|grounded 19/19|unsupported 0|gates green 1/1|proven able to fail 1/1|never bitten 0|green at 0/0 0|open gaps 3|of them unnamed 0|of them proof withheld 0|flips ready 0

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 19 vs present 19 · named + unnamed + withheld = 3 vs open 3 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 10644 bytes · gates map: PRIMARY · stamped 1d 7h ago · source ../knowledge/status/evstamp_containers.verdict

Gap classWhat it is, and the work it names
NONENo gap class fires on this board: every published claim is grounded, the declared gates ran and were green, no watch contract is unnamed or already landed, and the stamp is inside its TTL. That is a statement about evidence, not about depth, scale or polish.
This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence containers itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_INCONSISTENT. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_INCONSISTENT. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

RungCloses withDefinition of done (pre-declared)ExecutorEst.
Job-Object governance (CT0)SetInformationJobObjectBasic Job limits live on the governed child -- LANDEDOrgan0 u
Content-addressed registry (CR0)CONTAINERREGISTRYGATEPut and get by digest, tampered blob refused -- LANDED gatedOrgan0 u
Quota depth (CT1)
after CT0		pe_job_quota_setcpu-rate, working-set and io quotas read from the ContainerSpec and applied to the Job before CreateProcessW; gate proves a child that exceeds its working-set quota is BOUNDED (page-faulted, not killed) and a spec without quotas is refused by the emitterOrgan1.5 u
Syscall filter (CT2)
after CT0		sc_syscall_filterA per-spec deny-list enforced on the governed child through the host's native mitigation policy surface; gate proves a denied call in the child fails with the policy named while the same binary outside the filter succeeds (the positive control)Organ3 u
P2P publish by digest (CT3)
after CR0		reg_p2p_publishPublish a registry blob onto the live torrent plane keyed by its SHA-256; gate proves a second host pulls it peer-to-peer and the digest verifies, and a corrupted piece is refused by the same checkOrgan1.5 u

Milestones

MilestoneRungsCumulative
M1 · Bounded childrenCT11.5 u
M2 · Distributed by digestCT33 u
M3 · Filtered like the Linux stackCT26 u
RungCloses withDefinition of done (pre-declared)ExecutorEst.
Reference tools run on demand with complete owned lifecycle (CT4)
after CT1,CR0		_ABSENT_:oracle_tool_journey_acceptSOURCE-BOUND PLANNING CONTRACT 2026-09-24. Compose nx_container, the content-addressed registry and existing job/host resource owners. A versioned reference-tool definition names dependency/license identities, admitted host resources, inputs, expected evidence and owner. One callable workflow prepares and invokes the reference outside the sovereign build path, retains complete outputs and exact identity, and releases processes/resources on success, failure, cancellation and abandoned-run recovery. Prove ready reuse, cold preparation, missing dependency UNAVAILABLE, denied resource admission, nonzero child, cancellation and cleanup using an actual representative existing viewer/rigger. No permanent background load is required for an on-demand reference; no model provider is contacted. Human interpretation of reference results remains distinct from a successful container run. Effort unestimated.Workflowunestimated u
Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.
Bar freshness, counted
ClassCountNote
bars0sotabar rows on the plan
fresh0the bar month is the current month
attested0an older bar with a this-month barscan reporting no newer entry
stale0a this-month scan saw a newer month the bar ignores
unattested0nobody looked this month
malformed0a sotabar row missing a field
duplicate0bar ids an earlier row already carries
bars, summed0RECONCILED: the parts sum to the total 0
current month2026-10the month every bar is judged against
Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 6. Rank input binding: STALE_INCONSISTENT. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 5268e050f905d34b18d192147bafd376142b3a25b81885774b4da62ed151b605. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 6 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

  1. CT0 — Job-Object governance

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: SetInformationJobObject

    Acceptance: Basic Job limits live on the governed child -- LANDED

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  2. CR0 — Content-addressed registry

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: CONTAINERREGISTRYGATE

    Acceptance: Put and get by digest, tampered blob refused -- LANDED gated

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  3. CT1 — Quota depth

    Prerequisites: CT0 (acceptance unverified)

    Contract: pe_job_quota_set

    Acceptance: cpu-rate, working-set and io quotas read from the ContainerSpec and applied to the Job before CreateProcessW; gate proves a child that exceeds its working-set quota is BOUNDED (page-faulted, not killed) and a spec without quotas is refused by the emitter

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  4. CT2 — Syscall filter

    Prerequisites: CT0 (acceptance unverified)

    Contract: sc_syscall_filter

    Acceptance: A per-spec deny-list enforced on the governed child through the host's native mitigation policy surface; gate proves a denied call in the child fails with the policy named while the same binary outside the filter succeeds (the positive control)

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  5. CT3 — P2P publish by digest

    Prerequisites: CR0 (acceptance unverified)

    Contract: reg_p2p_publish

    Acceptance: Publish a registry blob onto the live torrent plane keyed by its SHA-256; gate proves a second host pulls it peer-to-peer and the digest verifies, and a corrupted piece is refused by the same check

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

  6. CT4 — Reference tools run on demand with complete owned lifecycle

    Prerequisites: CT1 (acceptance unverified), CR0 (acceptance unverified)

    Contract: _ABSENT_:oracle_tool_journey_accept

    Acceptance: SOURCE-BOUND PLANNING CONTRACT 2026-09-24. Compose nx_container, the content-addressed registry and existing job/host resource owners. A versioned reference-tool definition names dependency/license identities, admitted host resources, inputs, expected evidence and owner. One callable workflow prepares and invokes the reference outside the sovereign build path, retains complete outputs and exact identity, and releases processes/resources on success, failure, cancellation and abandoned-run recovery. Prove ready reuse, cold preparation, missing dependency UNAVAILABLE, denied resource admission, nonzero child, cancellation and cleanup using an actual representative existing viewer/rigger. No permanent background load is required for an on-demand reference; no model provider is contacted. Human interpretation of reference results remains distinct from a successful container run. Effort unestimated.

    Authored effort: unestimated. Executor kind: Workflow. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.
Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence containers writes it beside its stamp); every gate below reads UNRECORDED until it runs.
Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.
CT0 Job-Object governance · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
ContractSetInformationJobObject · executor Organ · 0 u · stands on nothing
Definition of doneBasic Job limits live on the governed child -- LANDED
Matrix cellNO-MATRIX-ROW — no matrix row carries SetInformationJobObject; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work logno log row names this rung yet
CR0 Content-addressed registry · cell PRESENT · gate NO-GATE-DECLARED
ContractCONTAINERREGISTRYGATE · executor Organ · 0 u · stands on nothing
Definition of donePut and get by digest, tampered blob refused -- LANDED gated
Matrix cellImage registry and distribution · runtime/nx_container_registry.nx · PRESENT marker
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_container_registry; declare nx_container_registry TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
CT1 Quota depth · cell WATCHING · gate NO-GATE-DECLARED
Contractpe_job_quota_set · executor Organ · 1.5 u · stands on CT0
Definition of donecpu-rate, working-set and io quotas read from the ContainerSpec and applied to the Job before CreateProcessW; gate proves a child that exceeds its working-set quota is BOUNDED (page-faulted, not killed) and a spec without quotas is refused by the emitter
Matrix cellResource quota depth (cpu, memory, io bound per governed child) · runtime/nx_pe_container_win.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_pe_container_win; declare nx_pe_container_win TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
CT2 Syscall filter · cell WATCHING · gate NO-GATE-DECLARED
Contractsc_syscall_filter · executor Organ · 3 u · stands on CT0
Definition of doneA per-spec deny-list enforced on the governed child through the host's native mitigation policy surface; gate proves a denied call in the child fails with the policy named while the same binary outside the filter succeeds (the positive control)
Matrix cellSyscall-filter sandboxing depth · runtime/nx_container_seccomp.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_container_seccomp; declare nx_container_seccomp TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
CT3 P2P publish by digest · cell WATCHING · gate NO-GATE-DECLARED
Contractreg_p2p_publish · executor Organ · 1.5 u · stands on CR0
Definition of donePublish a registry blob onto the live torrent plane keyed by its SHA-256; gate proves a second host pulls it peer-to-peer and the digest verifies, and a corrupted piece is refused by the same check
Matrix cellP2P image distribution over the live torrent plane · runtime/nx_container_registry.nx · WATCHING decl
GateNO-GATE-DECLARED — knowledge/organ_gate.conf carries no row for nx_container_registry; declare nx_container_registry TAB <gate> and the ship loop proves it and the verdict lands here.
Work logno log row names this rung yet
CT4 Reference tools run on demand with complete owned lifecycle · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW
Contract_ABSENT_:oracle_tool_journey_accept · executor Workflow · unestimated u · stands on CT1, CR0
Definition of doneSOURCE-BOUND PLANNING CONTRACT 2026-09-24. Compose nx_container, the content-addressed registry and existing job/host resource owners. A versioned reference-tool definition names dependency/license identities, admitted host resources, inputs, expected evidence and owner. One callable workflow prepares and invokes the reference outside the sovereign build path, retains complete outputs and exact identity, and releases processes/resources on success, failure, cancellation and abandoned-run recovery. Prove ready reuse, cold preparation, missing dependency UNAVAILABLE, denied resource admission, nonzero child, cancellation and cleanup using an actual representative existing viewer/rigger. No permanent background load is required for an on-demand reference; no model provider is contacted. Human interpretation of reference results remains distinct from a successful container run. Effort unestimated.
Matrix cellNO-MATRIX-ROW — no matrix row carries oracle_tool_journey_accept; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gatethe gate join needs a matrix row: no organ is named for this rung
Work log2026-10-02 queue INTAKE 1790952449 routed by nx_intake_route (codex-root, epoch 1790952847) from codex-root: [resource-management][NAS foundation priority] Operator feedback2026-10-02: "this doesnt seem sota to not proactively manage the resources id like the nishi estate and future nishi os and nishi browse -- sponsor intake-1790952449 plus2

dossiers=6 cells_joined=4 no_matrix_row=2 (sum 6) gates_recorded=0 gates_unrecorded=0 no_gate_declared=4 (sum 4 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 22 feature rows mapped of 22 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map
Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/containers.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults
Position map, two-dimensional cutOne bubble per player. Bubble area is breadth, the ring colour is momentum, the dashed lines are the category means, and both axes are fitted to the field of play with their tick numerals shown. Every value is repeated in the table that follows. 750 800 850 900 950 1000 100 150 200 250 300 350 centrality (permil, fitted 750–1000) distinctiveness (permil, fitted 100–350) mean 917 mean 184 Unconventional Aspirational Peripheral Mainstream Nishi, centrality 807, distinctiveness 200, breadth 469, depth 688, momentum 0 Docker Desktop, centrality 951, distinctiveness 142, breadth 500, depth 647, momentum 0 Portainer, centrality 939, distinctiveness 122, breadth 439, depth 568, momentum 0 Podman, centrality 951, distinctiveness 151, breadth 500, depth 647, momentum 0 Kubernetes, centrality 939, distinctiveness 308, breadth 636, depth 823, momentum 0 Nishi Docker Desktop Portainer Podman Kubernetes

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 750–1000, distinctiveness 100–350 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 659 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)
Position map, three-dimensional cubeThe same players in an isometric cube. Each axis is fitted to its own field of play and carries numerals on the floor grid and the vertical axis; each bubble drops a dotted line to its floor shadow so height reads as height. Values are in the table that follows. 750 800 850 900 950 1000 100 150 200 250 300 350 400 450 500 550 600 650 700 centrality distinctiveness breadth Nishi: centrality 807, distinctiveness 200, breadth 469 Portainer: centrality 939, distinctiveness 122, breadth 439 Docker Desktop: centrality 951, distinctiveness 142, breadth 500 Podman: centrality 951, distinctiveness 151, breadth 500 Kubernetes: centrality 939, distinctiveness 308, breadth 636 Nishi Docker Desktop Portainer Podman Kubernetes
axes fitted: centrality 750–1000 · distinctiveness 100–350 · breadth 400–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 2 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 280 permil of the plot
Position map, small multiplesEvery pair of registered axes as one small cut. Each panel fits both axes to the field of play, the dashed lines are the category means, bubble area is breadth and the ring colour is momentum; the legend below names the colours. 750 1000 100 350 distinctiveness vs centrality Nishi: centrality 807, distinctiveness 200 Docker Desktop: centrality 951, distinctiveness 142 Portainer: centrality 939, distinctiveness 122 Podman: centrality 951, distinctiveness 151 Kubernetes: centrality 939, distinctiveness 308 750 1000 400 700 breadth vs centrality Nishi: centrality 807, breadth 469 Docker Desktop: centrality 951, breadth 500 Portainer: centrality 939, breadth 439 Podman: centrality 951, breadth 500 Kubernetes: centrality 939, breadth 636 750 1000 500 900 depth vs centrality Nishi: centrality 807, depth 688 Docker Desktop: centrality 951, depth 647 Portainer: centrality 939, depth 568 Podman: centrality 951, depth 647 Kubernetes: centrality 939, depth 823 750 1000 480 520 momentum vs centrality Nishi: centrality 807, momentum 500 Docker Desktop: centrality 951, momentum 500 Portainer: centrality 939, momentum 500 Podman: centrality 951, momentum 500 Kubernetes: centrality 939, momentum 500 100 350 400 700 breadth vs distinctiveness Nishi: distinctiveness 200, breadth 469 Docker Desktop: distinctiveness 142, breadth 500 Portainer: distinctiveness 122, breadth 439 Podman: distinctiveness 151, breadth 500 Kubernetes: distinctiveness 308, breadth 636 100 350 500 900 depth vs distinctiveness Nishi: distinctiveness 200, depth 688 Docker Desktop: distinctiveness 142, depth 647 Portainer: distinctiveness 122, depth 568 Podman: distinctiveness 151, depth 647 Kubernetes: distinctiveness 308, depth 823 100 350 480 520 momentum vs distinctiveness Nishi: distinctiveness 200, momentum 500 Docker Desktop: distinctiveness 142, momentum 500 Portainer: distinctiveness 122, momentum 500 Podman: distinctiveness 151, momentum 500 Kubernetes: distinctiveness 308, momentum 500 400 700 500 900 depth vs breadth Nishi: breadth 469, depth 688 Docker Desktop: breadth 500, depth 647 Portainer: breadth 439, depth 568 Podman: breadth 500, depth 647 Kubernetes: breadth 636, depth 823 400 700 480 520 momentum vs breadth Nishi: breadth 469, momentum 500 Docker Desktop: breadth 500, momentum 500 Portainer: breadth 439, momentum 500 Podman: breadth 500, momentum 500 Kubernetes: breadth 636, momentum 500 500 900 480 520 momentum vs depth Nishi: depth 688, momentum 500 Docker Desktop: depth 647, momentum 500 Portainer: depth 568, momentum 500 Podman: depth 647, momentum 500 Kubernetes: depth 823, momentum 500
Nishi Docker Desktop Portainer Podman Kubernetes
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 15 (a fact of the data: two players that close are that close) · data spread 521 permil of the plot
PlayerQuadrantcentralitydistinctivenessbreadthdepthmomentumRows heldDays on spineFirst seen
NishiUnconventional8072004696880 since 2026-09-2315102026-09-15
Docker DesktopMainstream9511425006470 since 2026-09-2317102026-09-15
PortainerMainstream9391224395680 since 2026-09-2317102026-09-15
PodmanMainstream9511515006470 since 2026-09-2317102026-09-15
KubernetesAspirational9393086368230 since 2026-09-2317102026-09-15
DayMatrix rows reviewedPlayers recorded
2026-09-15225
2026-09-16225
2026-09-17225
2026-09-18225
2026-09-19225
2026-09-20225
2026-09-21225
2026-09-22225
2026-09-23225
2026-10-08225

players 5|matrix rows 22|feature mass 83|centrality mean 917|distinctiveness mean 184|axes 5|spine days 10 (shown 10)|rows written today 0|readability defects 2D 0 cube 2|spine knowledge/status/cdmap/containers.spine

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 88, unassessed 0. Authored assessments are not verified outcomes.

CapabilityNishiDocker DesktopPortainerPodmanKubernetes
Process isolation primitiveMeasured: nx_pe_emit_container exists in runtime/nx_pe_container_win.nx, verified at emit. Linux stack isolates via namespaces plus cgroups and K8s pods; Portainer delegates to the engine it manages; Nishi governs natively via Windows Job Objects [win-job-objects]. SYMBOL REPOINTED 2026-09-01: the row cited CreateJobObjectW, which is a WINDOWS API NAME and not a sovereign function, so the one-symbol ruler correctly refused it and the OLD substring ruler had been grounding the row against a COMMENT. THE SAME ROW APPEARS IN THREE BOARDS (containers, swarm, workermesh) AND WAS THE ENTIRE RED FOR ALL THREE -- one cause, three domains, which is why collapsing to causes before sizing a campaign matters. The defining sovereign function in that organ is nx_pe_emit_container. A ROW THAT CITES A FOREIGN OS API HAS NO SOVEREIGN DEFINITION TO GROUND AGAINST -- name the wrapper, never the syscall it wraps Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separate; ahead of PortainerCons not adopted yet: source exists, never compiled: /api/build it
●●◐●●
Lifecycle governance run-wait-reapMeasured: nx_pe_emit_container exists in runtime/nx_pe_container_win.nx, verified at emit. Nishi container PE creates the Job then CreateProcessW then Wait then ExitCode then clean reap -- proven live governing the CUDA engine. SYMBOL REPOINTED 2026-09-01: the row cited a WINDOWS API NAME, which has no sovereign definition to ground against, so the one-symbol ruler correctly refused it while the OLD substring ruler had been matching it inside a COMMENT. Name the wrapper, never the syscall it wraps. ⚠READ THIS BEFORE COUNTING THIS BOARD AS FOUR CAPABILITIES: nx_pe_container_win.nx defines exactly ONE public function, nx_pe_emit_container, and FOUR axes on this board now ground on it. That is honest (the organ header says it composes the Job boundary plus limit plus CreateProcessW plus Wait plus GetExitCode plus reap in one emitter) but it is THIN EVIDENCE -- four claimed capabilities backed by one symbol are not four independent groundings, and the right fix is to split the emitter so each axis has its own provable surface. Stated rather than hidden, because a row that grounds is not the same as a row that is separately evidenced rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: source exists, never compiled: /api/build it
●●●●●
Declarative service specOpen — no implementing organ is measured for this axis yet. K8s declarative YAML is the reference; Compose files yes; Portainer edits stacks over an engine; Nishi ContainerSpec drives the emitter from data rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
Pros none measured yetCons behind Docker Desktop, Portainer, Podman, Kubernetes (leads); no implementing organ measured
○●◐●◉
Build runnable artifact from specMeasured: CONTAINERSPECGATE exists in runtime/nx_container_spec_emit.nx, verified at emit. docker build with BuildKit is Best in class; podman build yes; K8s delegates builds; Nishi stamps the spec onto a proven 2560-byte governance PE template rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separate; ahead of Portainer, KubernetesCons behind Docker Desktop (leads); not adopted yet: source exists, never compiled: /api/build it
●◉◐●○
Multi-service orchestration dependency orderMeasured: CONTAINERCOMPOSEGATE exists in runtime/nx_container_compose.nx, verified at emit. K8s is the orchestration reference; compose depends_on yes; podman kube partial; Nishi topological planner rejects cycles and missing deps by construction rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separate; ahead of Portainer, PodmanCons behind Kubernetes (leads); not adopted yet: source exists, never compiled: /api/build it
●●◐◐◉
Health probe plus auto-restart supervisionMeasured: crash-loop exists in runtime/_hdl_build/nx_hostctl.nx, verified at emit. K8s liveness and readiness probes are Best [k8s-probes]; Docker healthcheck and restart policies; Nishi hostctl supervise runs live in production (PID-liveness plus SERVING probe HUNG-aware plus crash-loop backoff) AND the Windows container PE now self-restarts its governed child -- respawn proven live with 3 distinct child PIDs, hand-emitted in a 2560-byte PE Adoption: PRODUCER-ALIAS — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Podman; fully adopted on the estate ladderCons behind Kubernetes (leads)
●●●◐◉
Never-brick deploy health-gated promote auto-rollbackMeasured: ma_do_deploy exists in runtime/_hdl_build/nx_mgmt_api.nx, verified at emit. K8s rolling update can undo; plain Docker and Podman have none; Portainer redeploys without health-gated auto-rollback; Nishi /api/deploy watchdog rolls back BY CONSTRUCTION rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIVE-DAEMON — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Docker Desktop, Portainer, Podman; fully adopted on the estate ladderCons behind Kubernetes (leads)
●○◐○◉
One-command source to live pipelineMeasured: SHIPPED exists in runtime/nx_ship.nx, verified at emit. Portainer GitOps stack redeploy is its strength; Nishi nx_ship packs then uploads then builds on target over sovereign TLS in one command rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: RUN-BY:fork:nx_ws_hygiene_gate — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Docker Desktop, Podman, Kubernetes; fully adopted on the estate ladderCons behind Portainer (leads)
●◐◉◐◐
Live fleet inventory APIMeasured: /api/services exists in runtime/_hdl_build/nx_mgmt_api.nx, verified at emit. Portainer UI and kubectl get are Best; docker ps yes; Nishi GET /api/services serves the live multi-service inventory over the sovereign mgmt API rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIVE-DAEMON — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Portainer (leads), Kubernetes (leads)
●●◉●◉
Event stream monitoring hooksMeasured: event-stream exists in runtime/_hdl_build/nx_mgmt_api.nx, verified at emit. docker events yes; K8s watch API Best; Nishi GET /api/events serves text/event-stream to EventSource clients rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: LIVE-DAEMON — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes (leads)
●●●●◉
Container fleet management web UIMeasured: ma_emit_dashboard exists in runtime/_hdl_build/nx_mgmt_api.nx, verified at emit. Portainer is the reference container UI but needs a root-equivalent engine socket [portainer-docs]; Nishi Sovereign Fleet at /health is LIVE behind the operator login -- per-service cards with state and crash-loop and port-squatter warnings, allowlisted restart actions, deploy status and an SSE live tick, rendered by the engine itself Adoption: LIVE-DAEMON — fully adopted (top of its ladder).
Pros Implementing source symbol found; runtime acceptance separate; ahead of Docker Desktop, Podman; fully adopted on the estate ladderCons behind Portainer (leads), Kubernetes (leads)
●◐◉◐◉
GPU workloads in containersMeasured: sd-server exists in runtime/nx_pe_container_sdserver.nx, verified at emit. Docker Desktop routes GPU through the WSL2 VM [docker-desktop-gpu]; podman CDI and K8s device plugins are Linux-native; the Nishi-governed child owns the RTX 5080 natively -- 10.9GB VRAM Z-Image generation proven live Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separate; ahead of Docker Desktop, PortainerCons not adopted yet: source exists, never compiled: /api/build it
●◐◐●●
Rootless least-privilege operationMeasured: nx_pe_emit_container exists in runtime/nx_pe_container_win.nx, verified at emit. Podman pioneered rootless and is Best [podman-rootless]; Docker rootless mode is non-default; Portainer needs the engine socket which is root-equivalent; Nishi runs as the plain user with zero daemon and zero admin. SYMBOL REPOINTED 2026-09-01: the row cited a WINDOWS API NAME, which has no sovereign definition to ground against, so the one-symbol ruler correctly refused it while the OLD substring ruler had been matching it inside a COMMENT. Name the wrapper, never the syscall it wraps. ⚠READ THIS BEFORE COUNTING THIS BOARD AS FOUR CAPABILITIES: nx_pe_container_win.nx defines exactly ONE public function, nx_pe_emit_container, and FOUR axes on this board now ground on it. That is honest (the organ header says it composes the Job boundary plus limit plus CreateProcessW plus Wait plus GetExitCode plus reap in one emitter) but it is THIN EVIDENCE -- four claimed capabilities backed by one symbol are not four independent groundings, and the right fix is to split the emitter so each axis has its own provable surface. Stated rather than hidden, because a row that grounds is not the same as a row that is separately evidenced Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separate; ahead of Docker Desktop, Portainer, KubernetesCons behind Podman (leads); not adopted yet: source exists, never compiled: /api/build it
●◐○◉◐
Resource limit quotasMeasured: nx_pe_emit_container exists in runtime/nx_pe_container_win.nx, verified at emit. cgroups give full cpu-mem-io quotas and K8s requests-limits are Best [linux-namespaces7]; Nishi Job-Object limits are basic today -- quota depth is a named gap. SYMBOL REPOINTED 2026-09-01: the row cited a WINDOWS API NAME, which has no sovereign definition to ground against, so the one-symbol ruler correctly refused it while the OLD substring ruler had been matching it inside a COMMENT. Name the wrapper, never the syscall it wraps. ⚠READ THIS BEFORE COUNTING THIS BOARD AS FOUR CAPABILITIES: nx_pe_container_win.nx defines exactly ONE public function, nx_pe_emit_container, and FOUR axes on this board now ground on it. That is honest (the organ header says it composes the Job boundary plus limit plus CreateProcessW plus Wait plus GetExitCode plus reap in one emitter) but it is THIN EVIDENCE -- four claimed capabilities backed by one symbol are not four independent groundings, and the right fix is to split the emitter so each axis has its own provable surface. Stated rather than hidden, because a row that grounds is not the same as a row that is separately evidenced Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Implementing source symbol found; runtime acceptance separateCons behind Kubernetes (leads); not adopted yet: source exists, never compiled: /api/build it
●●●●◉
Syscall-filter sandboxing depthOpen — watching runtime/nx_container_seccomp.nx : sc_syscall_filter, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. seccomp and AppArmor ship default on the Linux stack [docker-seccomp] and gVisor or Kata harden further; Nishi has Job-Object boundaries only -- no syscall filter yet
dossierwatching sc_syscall_filter
Pros none measured yetCons behind Docker Desktop, Portainer, Podman, Kubernetes (leads); open contract; expected source declaration not established
○●●●◉
Resource quota depth (cpu, memory, io bound per governed child)DARK — runtime/nx_pe_container_win.nx EXISTS but does not declare pe_job_quota_set: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. The resource-limit row above is present at BASIC Job-Object depth; cgroups v2 and K8s requests-limits bound cpu, memory and io per container -- the contract is per-spec cpu-rate, working-set and io quotas applied to the Job before the child starts, proven by a child that exceeds its quota being bounded not killed rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching pe_job_quota_set
Pros none measured yetCons behind Docker Desktop, Portainer, Podman, Kubernetes (leads); open contract; expected source declaration not established
○●●●◉
P2P image distribution over the live torrent planeDARK — runtime/nx_container_registry.nx EXISTS but does not declare reg_p2p_publish: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the comparewatch- plane row reads DARK until then. The content-addressed registry row above is present; Docker Hub plus OCI distribution is the ecosystem reference -- the contract named in that row's own note is publish-by-digest onto the live torrent plane so a second host pulls a container PE peer-to-peer and verifies the same SHA-256 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them
dossierwatching reg_p2p_publish
Pros none measured yetCons behind Docker Desktop (leads), Portainer, Podman (leads), Kubernetes; open contract; expected source declaration not established
○◉◐◉●
Image registry and distributionMeasured: CONTAINERREGISTRYGATE exists in runtime/nx_container_registry.nx, verified at emit. Docker Hub plus OCI distribution is the ecosystem Best and Podman is full OCI [oci-distribution]; Nishi now has a sovereign content-addressed registry -- put and get by name where the SHA-256 digest IS the address (dedup plus integrity by construction), a tampered blob is refused on pull; proven on real container PEs (byte-identical round-trip), P2P distribution over the live torrent plane is the next rung Adoption: BUILT-UNPROMOTED — PARTIAL: compiled, never promoted to the serving root: /api/promote it.
dossiernot adopted: compiled, never promoted to the serving root: /api/promote it
Pros Implementing source symbol found; runtime acceptance separate; ahead of PortainerCons behind Docker Desktop (leads), Podman (leads); not adopted yet: compiled, never promoted to the serving root: /api/promote it
●◉◐◉●
EXCEED measured: idle overhead 0 MB 0 processesOpen — no implementing organ is measured for this axis yet. Measured live on this host: Nishi 0 MB and 0 procs idle vs Docker Desktop 2774 MB and 6 procs [docker-desktop-docs]; a K8s control plane is heavier still; verdicts computed by the liar-killed judge nx_container_bench
Pros none measured yetCons no implementing organ measured
○○○○○
EXCEED measured: runtime install 2560 bytesOpen — no implementing organ is measured for this axis yet. The whole Nishi container runtime is a 2560-byte PE vs Docker Desktop 4.11 GB install [docker-desktop-docs]; Portainer adds hundreds of MB on top of an engine it requires
Pros none measured yetCons no implementing organ measured
○○○○○
EXCEED measured: cold start 976 ms with zero VM taxOpen — no implementing organ is measured for this axis yet. First governed process 976 ms vs Docker 1660 ms and isolation VM tax 0 vs 2225 MB -- no WSL2 or HyperV VM under the runtime on Windows [docker-desktop-docs]
Pros none measured yetCons no implementing organ measured
○○○○○
EXCEED sovereign: whole runtime auditable bits-upSource present; authored stronger claim: Job-governs in runtime/nx_pe_container_sdserver.nx, verified at emit. The entire runtime emitter orchestrator and judge are readable sovereign source with zero third-party dependencies; incumbents are millions of lines over kernel plumbing no operator can audit Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it.
not adopted: source exists, never compiled: /api/build it
Pros Source symbol found; stronger capability claim is authored; ahead of Docker Desktop, Portainer, Podman, KubernetesCons not adopted yet: source exists, never compiled: /api/build it
◉○○○○
Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.
Rival claims, counted
ClassCountNote
rows with rival marks18rows carrying a Yes, Best or Part in a rival column
cited8a reference mark resolves to a pinned mirror
uncited10an observation read, badged until a reference lands
rows, summed18RECONCILED: the parts sum to the total 18

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

RiskLikelihood x impactMitigation
A filter that blocks a call the governed CUDA engine needs bricks image-gen, the only production workloadpossible x highCT2 ships with the positive control (the engine's full syscall set recorded first) and never-brick deploy behind it.
Quotas that kill instead of bound turn a slow child into an outagepossible x mediumCT1 done-rule is BOUNDED not killed; the kill path stays the supervisor's, single responsibility.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.
WhenRungKindEntry
2026-10-02CT4queueINTAKE 1790952449 routed by nx_intake_route (codex-root, epoch 1790952847) from codex-root: [resource-management][NAS foundation priority] Operator feedback2026-10-02: "this doesnt seem sota to not proactively manage the resources id like the nishi estate and future nishi os and nishi browse -- sponsor intake-1790952449 plus2
On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.
Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/containers.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain containers, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from containers.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.
Field discovery, counted
ClassCountNote
seeds4
scanned4
fetched4
reused0
failed0
named4
candidates4
mentions4
capped0
RankRivalSeedsMentionsFirst seedKindLink
1Docker Desktop11col0-dockernamedhttps://docs.docker.com/desktop/
2Portainer11col1-portainernamedhttps://docs.portainer.io/
3Podman11col2-podmannamedhttps://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md
4Kubernetes11col3-kubernetesnamedhttps://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

field candidates 4|shown 4 of 4|matrix columns in the field 4 of 4|discovered rivals with no column 0|malformed rows 0 (counted, never rendered)|read-capped 0

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 19 capabilities: 10 exclusive to it and 9 shared with other boards. Shared rows on this page: 9 = home here 1 + home elsewhere 0 + ambiguous 0 + undecided 8 + refused 0 (partition 9); undecided = unmapped 0 + unproven 8 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6458.

CapabilityOrganBoards grading itHomeRuleEvidenceStanding on this board
event-streamnx_mgmt_api.nxautomation, deploy, containers—noneunprovenundecided
ma_do_deploynx_mgmt_api.nxcms, containers—noneunprovenundecided
SHIPPEDnx_ship.nxdeploy, containers—noneunprovenundecided
crash-loopnx_hostctl.nxdeploy, containers—noneunprovenundecided
/api/servicesnx_mgmt_api.nxdeploy, containers—noneunprovenundecided
ma_emit_dashboardnx_mgmt_api.nxdeploy, containers—noneunprovenundecided
nx_pe_emit_containernx_pe_container_win.nxswarm, workermesh, containers—noneunprovenundecided
CONTAINERREGISTRYGATEnx_container_registry.nxswarm, workermesh, containers*containersrungplanhome here
sd-servernx_pe_container_sdserver.nxworkermesh, containers—noneunprovenundecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395563 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kindnameboardsourceevidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.
  1. [docker-desktop-docs] Docker Inc. Docker Desktop documentation (docs.docker.com/desktop): the Windows/macOS/Linux desktop product that bundles Docker Engine, CLI, Compose and BuildKit inside a managed VM (WSL 2 or Hyper-V backend on Windows). publisher · read in our library knowledge/fetched/cmp_containers_docker-desktop.html · pin h5302a649aeea9618d7da96a9736c3651f6369d50dbc6edef137ac1feb90a5f6e · accessed 2026-08-18 · vendor-docGrounds: The Docker Desktop column across the register and the three EXCEED measured rows -- idle overhead 0 MB 0 processes, runtime install 2560 bytes, cold start 976 ms with zero VM tax: the 2774 MB / 6 processes / 4.11 GB / 1660 ms incumbent numbers were measured against THIS product on the same host, and its VM-backed architecture is why the isolation VM tax exists at all.
  2. [docker-desktop-gpu] Docker Inc. GPU support in Docker Desktop (docs.docker.com/desktop/features/gpu): NVIDIA GPU access from containers on Windows via the WSL 2 backend and the NVIDIA driver for WSL. publisher · read in our library knowledge/fetched/cmp_containers_docker-gpu.html · pin hd4164e8141f3e08200e516f740df49d6369666007febe2bcaed660cdf9c9bdaf · accessed 2026-08-18 · vendor-docGrounds: The GPU workloads in containers row: Docker Desktop routes the GPU through the WSL 2 VM (Part), which is the exact contrast to the Nishi-governed child owning the RTX 5080 natively -- 10.9 GB VRAM Z-Image generation proven live.
  3. [portainer-docs] Portainer.io. Portainer documentation (docs.portainer.io): container management UI for Docker, Docker Swarm, Kubernetes and Podman environments, deployed as a container connected to the engine socket or agent. publisher · read in our library knowledge/fetched/cmp_containers_portainer.html · pin h2b67056e20dc9563da7d28906b877cab158d740f023b9a08271d38047088d046 · accessed 2026-08-18 · vendor-docGrounds: The Portainer column: Container fleet management web UI (Best, but needs a root-equivalent engine socket), Live fleet inventory API (Best), One-command source to live pipeline (GitOps stack redeploy) and the Process isolation primitive note that Portainer delegates to the engine it manages.
  4. [podman-rootless] Containers project. Basic Setup and Use of Podman in a Rootless environment (docs/tutorials/rootless_tutorial.md in the podman repository): user namespaces, subuid/subgid, no daemon and no root required. publisher · read in our library knowledge/fetched/cmp_containers_podman-rootless.html · pin hc872c5bc6a95bd22216ac3c31eb42499bb459054d0d5cbced8da503d042ef094 · accessed 2026-08-18 · vendor-docGrounds: The Rootless least-privilege operation row where Podman is Best (pioneered rootless, daemonless) -- the bar the Nishi plain-user zero-daemon zero-admin PE is graded against -- and the Podman column on Build runnable artifact and Image registry and distribution (full OCI).
  5. [k8s-probes] The Kubernetes Authors. Configure Liveness, Readiness and Startup Probes (kubernetes.io/docs/tasks/configure-pod-container). publisher · read in our library knowledge/fetched/cmp_containers_k8s-probes.html · pin h2c91059571135379613836c808ab83040714818126088e3dd3b200f5accd1c93 · accessed 2026-08-18 · vendor-docGrounds: The Health probe plus auto-restart supervision row where K8s liveness and readiness probes are Best: the probe semantics (kubelet restarts a container that fails its liveness probe) are the bar hostctl supervise (PID-liveness plus SERVING probe HUNG-aware plus crash-loop backoff) and the self-restarting Windows container PE are measured against.
  6. [oci-distribution] Open Container Initiative. OCI Distribution Specification (opencontainers/distribution-spec): the HTTP API for pushing and pulling content-addressed blobs and manifests by digest. publisher · read in our library knowledge/fetched/cmp_containers_oci-distribution.html · pin h542d8e9ad33361f0277a813b4bef0fd7f0db878a173c36f8a75807163c14c6d1 · accessed 2026-08-18 · published-standardGrounds: The Image registry and distribution row: Docker Hub plus OCI distribution is the ecosystem Best and Podman is full OCI; the Nishi sovereign registry where the SHA-256 digest IS the address (dedup plus integrity by construction, tampered blob refused on pull) is a content-addressed store of the same shape without the ecosystem.
  7. [win-job-objects] Microsoft. Job Objects (Windows App Development, learn.microsoft.com/windows/win32/procthread/job-objects): a job object allows groups of processes to be managed as a unit with enforceable limits and kill-on-close semantics. publisher · read in our library knowledge/fetched/cmp_containers_win-job-objects.html · pin h82d0a4ab5248257c09dcced343ed87b5a729448e9d5f7ca13008592294942279 · accessed 2026-08-18 · vendor-docGrounds: The Process isolation primitive (CreateJobObjectW), Lifecycle governance run-wait-reap and Resource limit quotas (SetInformationJobObject) rows: the Windows kernel primitive the 2560-byte Nishi container PE governs with, and why quota depth is a named gap versus cgroups.
  8. [linux-namespaces7] Linux man-pages project. namespaces(7) -- overview of Linux namespaces (man7.org): the kernel isolation facility that, with cgroups, underlies Docker, Podman and Kubernetes pods. publisher · read in our library knowledge/fetched/cmp_containers_namespaces7.html · pin h7b8c94b7eeeb7a07dc063ecfb852959cbe32f01b7d4e33fe90eee9d4d4c1fdc0 · accessed 2026-08-18 · vendor-docGrounds: The Process isolation primitive row note that the Linux stack isolates via namespaces plus cgroups and K8s pods, and the Resource limit quotas row where cgroups give full cpu-mem-io quotas -- the Linux-native primitive set the Windows Job-Object lane is contrasted with.
  9. [docker-seccomp] Docker Inc. Seccomp security profiles for Docker (docs.docker.com/engine/security/seccomp): the default seccomp profile shipped with Docker Engine blocks a set of syscalls for every container. publisher · read in our library knowledge/fetched/cmp_containers_docker-seccomp.html · pin h98a4ffbab2d0856e58a4faa6c335b02b288bec61e2290c8fdbdabeac288c2b08 · accessed 2026-08-18 · vendor-docGrounds: The Syscall-filter sandboxing depth row (_ABSENT_ nx_container_seccomp): seccomp ships default on the Linux stack, which is the bar the Job-Object-only Nishi boundary is honestly marked 0 against -- gVisor and Kata harden further and are not cited here.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/containers.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls