On the recordRead 8 Oct 202617 facts
runc
On the record
- Build features
- Build tags include seccomp syscall filtering, libpathrs path safety, and an option to disable checkpoint and restore.github.com · read 8 Oct 2026
- Checkpoint and restore
- runc supports checkpoint and restore unless built with the runc_nocriu tag, which disables that feature.github.com · read 8 Oct 2026
- Container format
- A container must be provided as an OCI bundle, and runc can generate a base configuration with its spec command.github.com · read 8 Oct 2026
- Integrations
- The project documents using runc with Docker to prepare a root filesystem and with systemd or other process supervisors to manage containers.github.com · read 8 Oct 2026
- Intended users
- The project describes runc as a low-level tool mostly used by higher-level container software, and does not recommend using it directly for most users.github.com · read 8 Oct 2026
- License
- The code and documentation are released under the Apache 2.0 license.github.com · read 8 Oct 2026
- Lifecycle
- runc can run a container with one command or manage it through separate create, start, list, and delete operations.github.com · read 8 Oct 2026
- OCI bundles
- To use runc, a container must be provided in OCI bundle format.github.com · read 8 Oct 2026
- Path safety
- The libpathrs build feature provides path safety and is enabled by default in the listed build tags.github.com · read 8 Oct 2026
- Platform limit
- The project states that runc only supports Linux.github.com · read 8 Oct 2026
- Purpose
- runc is a command-line tool for spawning and running containers on Linux according to the OCI specification.github.com · read 8 Oct 2026
- Release integrity
- The project says all official releases are signed by one of the keys listed in the repository's runc.keyring file.github.com · read 8 Oct 2026
- Release signing
- The project says all official runc releases are signed by one of the keys listed in its repository keyring.github.com · read 8 Oct 2026
- Rootless mode
- runc can run containers without root privileges when user namespaces are enabled in the kernel.github.com · read 8 Oct 2026
- Security audit
- The project says a third-party security audit was performed by Cure53 and links to the report.github.com · read 8 Oct 2026
- Security feature
- The project lists seccomp syscall filtering as a build feature enabled by default, using libseccomp.github.com · read 8 Oct 2026
- Security reporting
- The OCI security policy directs vulnerability reports to [email protected] rather than GitHub issues or pull requests.github.com · read 8 Oct 2026
