runc

runc is a CLI tool for spawning and running containers according to the OCI (Open Container Initiative) specification. Originally developed as part of libcontainer by Docker in 2014 and donated to the Open Container Initiative in 2015, runc has over 11,000 stars as of 2026 and serves as the most widely used container runtime, powering Docker, containerd, Kubernetes (via containerd and CRI-O), Podman, and virtually every container platform. runc implements the OCI Runtime Specification, which defines the configuration and execution environment for containers (including namespaces, cgroups, mount points, devices, and capabilities), and the OCI Image Format (though runc itself consumes unpacked filesystems, not images directly). Key features include: container lifecycle management (create, start, kill, delete commands), OCI bundle support (consuming a config.json specification and root filesystem directory), Linux namespace isolation (PID, mount, network, UTS, IPC, user, and cgroup namespaces), cgroup management (applying CPU, memory, block I/O, and device limits via cgroup v1 and v2), seccomp filters (restricting system calls available to containers), AppArmor and SELinux security module support, capability dropping (following the principle of least privilege), rootless containers (running containers without root privileges using user namespace remapping), checkpoint and restore (CRIU integration for snapshotting and migrating running containers), terminal allocation for interactive containers, pivot_root and chroot for filesystem isolation, and hooks for custom pre-start and post-start actions.