BusyBox,
reborn in Rust.
A free-range, non-GMO fork of BusyBox — the whole toolbox in one fully-static binary, now memory-safe and built for the agentic era.
# 100% parity across modern applets & dual-edition licensing $ rustybox-core --version # MIT edition, zero GPL code rustybox-core 0.3.0 (MIT edition) · commit: 526c101f $ rustybox-core sha256sum archive.tar.gz # RustCrypto engine $ rustybox grep -rn TODO src/ # ripgrep engine $ rustybox timeout 30 ./flaky-cmd # agentic harness $ file rustybox-core-x86_64-unknown-linux-musl rustybox-core-x86_64-unknown-linux-musl: ELF, statically linked, not a dynamic executable
Why rustybox
One static binary
Fully-static musl for x86_64 and aarch64. Drop it into a container FROM scratch, a rescue image, or a sandbox — no libc, no dependencies.
100% Parity on Safe Backends
Every permissive applet routes to battle-tested Rust: uutils coreutils, ripgrep's engine for grep, walkdir for find, RustCrypto hashes, and flate2/tar/xz2 archives.
MIT Edition (rustybox-core)
Need a permissively licensed userland? rustybox-core compiles zero GPL code, giving you all 85+ memory-safe applets under the MIT license.
Built for Entheai & Agents
timeout, xargs, watch, flock, find, shuf baked in — the official embedded userland for Entheai agent sandboxes to bound and script work safely.
Resurrected in the open
A six-year-dead c2rust transpile, brought back to a current toolchain and hardened arch-by-arch. Read the story →
Secure supply chain
Every release includes a keyless cosign cryptographic signature of the exact source code tree used to build it.
Security & Footprint Compare
How rustybox fares against upstream BusyBox on security, binary size, and command coverage.
Vulnerabilities (CVEs)
BusyBox has 64 total CVEs (buffer overflows, UAF, input exploits). Reimplementing applets in safe Rust completely eliminates these memory vulnerabilities.
Statically Linked Size
BusyBox's tiny C implementation is optimized for embedded footprint. Rustybox is larger due to safe Rust engines, but LTO + UPX brings it down to a highly portable package.
| Edition (Static musl) | Size |
|---|---|
| BusyBox (Stripped) | ~1.2 MB |
| BusyBox (UPX Compressed) | ~700 KB |
| rustybox-core (MIT) | ~25 MB |
| rustybox-core-slim (UPX) | ~3.2 MB |
Applet Coverage & Parity
Rustybox offers 100% functional parity across all permissive applets and supports full BusyBox emulation with dual-edition builds.
Build Pipeline
Official releases are supply-chain secured and heavily optimized.
1. Provenance
Source trees are archived and keylessly signed via Sigstore's cosign.
2. Dual Edition Build
Compiles both rustybox (GPL-2.0, 300+ applets) and rustybox-core (MIT, 85+ applets) with wild linker for x86_64 & aarch64 musl.
3. Compression
Payloads are packed with UPX down to ~4MB, keeping debug symbols.
4. *-slim Builds
We also distribute stripped, ultra-compressed -slim binaries (~3.2MB) for peak minimalism.
The toolbox
Pick your edition or feature set; features gate the dispatch table, not compile time.
Files & text
cat ls cp mv rm mkdir ln stat du df wc sort uniq head tail cut tr sed grep find tty hostid
Hashes & Archives
md5sum sha1sum sha256sum sha512sum sha3sum tar gzip gunzip zcat bzip2 bunzip2 bzcat xz unxz xzcat
Agent & ops
timeout xargs watch flock setsid chrt ionice mountpoint arch dd shuf env date base64 nproc
Full Edition (GPL)
ash hush awk vi wget mount umount ifconfig ip … 300+ applets from the BusyBox lineage
Install
# grab the MIT edition (rustybox-core) or full GPL edition from Releases curl -LO https://github.com/peterlodri-sec/rustybox/releases/latest/download/rustybox-core-x86_64-unknown-linux-musl chmod +x rustybox-core-* && ./rustybox-core-* --version # or build rustybox-core (MIT edition) directly from source cargo build --release -p rustybox-core
Sponsor the work
rustybox is built in the open, one honest commit at a time — resurrecting dead code, hardening it across architectures, and making the classic Unix toolbox memory-safe. If it saves you a dependency, a container megabyte, or a timeout around a runaway command, back it.
Name in SPONSORS.md + the warm glow of funding safe systems software.
Above + your name/handle in the project README.
Above + your logo right here on rustybox.io.
Above + logo up top + a say in which applets go memory-safe next.
One-time contributions welcome too · every sponsor credited (opt-out anytime)