Show HN: Nucleus – A security-hardened, Nix-native container runtime

Nucleus is a lightweight, security-hardened container runtime designed for Linux that uses kernel primitives to provide isolated execution environments with significantly lower overhead than traditional runtimes like Docker. It operates in three modes—agent mode for AI workloads, strict agent mode for ephemeral sandboxes, and production mode for long-running services—and integrates deeply with NixOS for fully declarative, reproducible deployments. Benchmarks show Nucleus achieves 12ms cold starts compared to Docker's ~500ms and maintains near bare-metal performance, while optional gVisor integration provides enhanced security at a ~62% performance cost.