Pack a binary and its libraries into a self-contained executable that runs everywhere a modern Linux kernel exists.
Invisible by default
Uses a private user+mount namespace plus FUSE so no mount ever shows up in the host, and kernel tears it down when the process exits. No fusermount3 dependency.
Cross-libc friendly
Run musl binaries on glibc hosts (or vice versa) with the bundled interpreter. No /tmp/.oi symlinks, no LD_PRELOAD trickery.
Delta self-update
Built-in zsync-based self-update. Just set the update URL at pack time and users run --onelf-update.
Reproducible
Same input with SOURCE_DATE_EPOCH set gives byte-identical output across machines.
Recipe-driven
Declarative onelf.toml makes packaging reviewable and shareable. Bundle + pack with one command.