crun

crun is a free OCI container runtime written in C for Linux and self-hosted environments. It conforms to the OCI Container Runtime specifications and provides command-line operations to create, run, execute commands in, list, pause, resume, update, checkpoint, and restore containers. For unprivileged use, crun can generate a configuration file and automatically creates a user namespace when run by a non-root user. The project documents integration with Podman through its runtime option, an Ansible role for installing a statically linked binary, and a Lua binding. Build instructions cover Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine, and openSUSE Tumbleweed. Release binaries are listed for Linux amd64 and arm64, including variants built with systemd disabled. Official release artifacts are signed, and the project provides GPG verification instructions. The project says its CI runs fuzz testing and code checks, and asks that vulnerability reports go through GitHub Security Advisories. It regularly issues patches for the latest version; fixes for earlier versions are best effort and not guaranteed. The manual says cgroup v1 support is deprecated and will be removed in a future release.

crun offers OCI-compatible container operations and rootless use for Linux environments, with integrations documented for Podman, Ansible, and Lua. Note the stated limits around cgroup v1 and support for versions older than the latest release.

crun suits Linux users and teams managing OCI containers in self-hosted environments, including those who need rootless operation or documented Podman integration. It is also aimed at contributors with C knowledge and a Linux environment.

crun is a free OCI container runtime for people who want to run or manage containers directly on Linux. It is especially well suited to rootless setups and Podman users who value a small runtime with a library interface. Its Linux focus and best-effort support for older releases make it a narrower choice for long-lived deployments.

Overview

crun implements the OCI Container Runtime specifications and provides commands to create, run, execute commands in, list, pause, resume, update, checkpoint, and restore containers. Programs that manage OCI containers can also use it as a library, avoiding an external process for runtime operations.

The project emphasizes speed and low memory use. Its README reports that 100 sequential /bin/true containers took 1.69 seconds with crun and 3.34 seconds with runc on the author's machine. That result gives performance-conscious Linux operators a reason to evaluate crun, though a single machine and simple command do not establish how it will perform on other workloads.

Key features

Rootless operation is a practical advantage for users who want to run containers without invoking the runtime as root. crun can generate a configuration for an unprivileged user and automatically creates a user namespace when started by a non-root user.

Podman can use crun through its --runtime option. An Ansible role automates installation of a statically linked binary, and a Lua binding offers another route for integrating the runtime into existing tooling. The CLI spans routine container management as well as checkpoint and restore operations, making crun useful beyond simply launching a container.

The project provides build instructions for Fedora, RHEL and CentOS Stream 9 and 10, Ubuntu, Alpine, and openSUSE Tumbleweed. Release binaries are offered for Linux amd64 and arm64, including builds without systemd. Official artifacts are signed, and the project provides GPG commands to verify them against its keyring.

Security reporting goes through GitHub Security Advisories rather than public issues or pull requests. The project says its CI uses honggfuzz and AddressSanitizer, along with clang-check and clang-format checks. It aims to acknowledge reports within three business days and handles confirmed issues according to their severity and impact. These practices provide a defined reporting path, while patch coverage remains strongest for the latest release: fixes for earlier versions are best effort unless a support matrix says otherwise.

Pricing

crun is free: the crun plan costs nothing and includes the OCI runtime as source code and release binaries. There is no paid tier or free trial to weigh against it. The trade-off is operational rather than financial: teams maintaining older releases should account for best-effort fixes, and users of cgroup v1 should plan for its deprecated status and eventual removal.

Platforms

crun is self-hosted software for Linux, with build instructions covering Fedora, RHEL and CentOS Stream, Ubuntu, Alpine, and openSUSE Tumbleweed. Linux amd64 and arm64 release binaries broaden the installation options. It does not support Windows containers, so teams needing a runtime for Windows workloads should choose another product.

Who it's for

crun suits Linux operators who need an OCI-compatible runtime, particularly those running containers rootlessly, using Podman, or embedding container management in their own programs. Its command-line breadth and integration paths also fit teams that automate installation or work with Lua.

It is a weaker fit for environments tied to cgroup v1 or requiring dependable security fixes for a pinned older release. Contributors should also expect to work in C and Linux, and pull requests require a Developer Certificate of Origin sign-off.

Pros and cons

• Pros: OCI compatibility and a broad set of container operations make it suitable for direct runtime management.
• Pros: Rootless configuration and automatic user namespaces support unprivileged Linux use.
• Pros: Podman, Ansible, and Lua integration give operators and developers several ways to adopt it.
• Pros: Free source and release binaries, signed artifacts, and a documented verification process keep licensing and distribution costs low.
• Cons: Linux-only support excludes Windows container workloads.
• Cons: cgroup v1 support is deprecated and slated for removal, which may require changes in older environments.
• Cons: Fixes for prior versions are not guaranteed, making the latest release the safer choice for ongoing patch coverage.

Alternatives

Choose Apptainer if you want a free open-source container platform across Linux, macOS, Windows, and API use, with commercial support available through partners. Docker Desktop is a better fit for users who want a desktop product spanning Linux, macOS, and Windows, with Docker Engine, Kubernetes, and related tools in its free Personal plan and a paid Pro plan at $9 a month.

gVisor is an alternative for Linux users seeking a sandbox, provided the host is Linux 5.6 or newer and runs x86_64 or ARM64. Incus is free software under the Apache 2 license and supports Linux, macOS, Windows, and API use. LXD offers KVM-based virtual machines and system containers for self-hosted deployment.

Rancher Desktop is a free desktop application for Linux, macOS, and Windows from SUSE's Rancher Engineering group. youki is a free, Apache-2.0-licensed option for Linux. Colima is a free MIT-licensed project for container runtimes on macOS and Linux.

Readers comparing categories can also browse Container Runtime Software, Container Engines, Sandbox Software, and Image Compression Software.

Verdict

Choose crun if you need a free, OCI-compatible Linux runtime with rootless operation and useful paths into Podman or custom tooling. Its low-footprint focus and broad management commands make it a compelling option for Linux-first teams. Look elsewhere if you need Windows containers, depend on cgroup v1, or must keep an older release covered by guaranteed fixes.