Enroot is a production-grade, unprivileged container sandboxing tool designed for high-performance computing (HPC) environments. It provides a CLI interface to import Docker images (from registries, Docker daemon, or Podman), create and manage container root filesystems (using squashfs images), and start containers with fine-grained namespace isolation (user, mount, PID, network, IPC, UTS) while preserving host integration (GPU, InfiniBand, cgroups). The architecture is a set of focused C utilities (enroot-mount, enroot-nsenter, enroot-switchroot, enroot-aufs2ovlfs, enroot-mksquashovlfs) orchestrated by well-structured Bash scripts (common.sh, docker.sh, runtime.sh). It relies on Linux kernel features (namespaces, overlayfs, seccomp) and external tools (curl, jq, parallel, squashfs-tools, zstd). The codebase demonstrates high craftsmanship with careful capability management, robust error handling, and a modular design that makes the C utilities independently reusable.