onelfOne file. Any Linux.

Pack an application and every library it needs into a single executable. It runs from a private mount, takes GPU drivers from the host on purpose, and leaves nothing behind.

Quick Start

How onelf Thinks

GitHub

app.onelf

$ onelf bundle-libs ./app --from-binary /usr/bin/app
Copied 52 libraries (177.7 MB) to ./app/lib
Injected AT_EXECFN bootstrap into 1 binaries
$ onelf pack ./app -o app.onelf --command bin/app
Payload: 63.0 MB (zstd level 12)
Output:  79.8 MB
$ ./app.onelf
mounted privately, running, nothing left behind

runtimemanifestpayloadone file, in that order

run

Runs invisibly

A private user and mount namespace plus FUSE. No mount shows up on the host, no helper is required, and the kernel tears everything down when the last process exits.

host

Decides one library at a time

GPU drivers must come from the host, and they bring their own libstdc++ and glibc. At launch, each library present on both sides is chosen by its symbol versions, never by directory order.

sysroot

Knows what it ships

Fill a bundle from a pinned sysroot's package database instead of scanning your machine. Plugins, schemas and data arrive because a package owns them, and every bundle records its provenance.

libc

Its own libc, anywhere

A bundle carries glibc and the loader, so it runs on musl hosts and on distributions older or newer than the one it was built on.

update

Delta updates, signed

zsync-based self-update with an Ed25519 signature checked before a single byte is replaced. Or leave the updater out and let a package manager do it.

recipe

A recipe, not a ritual

One onelf.toml captures the whole build. Same input, same bytes, on any machine, with SOURCE_DATE_EPOCH doing the rest.