crun
github.com
What it is
crun is a free, self-hosted OCI container runtime for Linux, written in C. It conforms to the OCI Container Runtime specifications and provides CLI operations for creating, running, executing commands in, listing, pausing, resuming, updating, checkpointing and restoring containers. It can generate a configuration for unprivileged use and creates a user namespace when run by a non-root user. The project documents integration with Podman, an Ansible role for installing a statically linked binary and a Lua binding. Build instructions cover Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine and openSUSE Tumbleweed; release binaries are listed for Linux amd64 and arm64, including variants without systemd. Official release artifacts are signed, with GPG verification commands provided. The project reports a benchmark of 100 sequential `/bin/true` containers completing in 1.69 seconds with crun versus 3.34 seconds with runc on the author's machine. The manual marks cgroup v1 support as deprecated. Regular patch releases target the latest version; fixes for earlier versions are best effort and not guaranteed.
Spec sheet
- Purpose
- crun is a fast, low-memory-footprint OCI container runtime written in C.Read 3 Oct 2026 · github.com
- Product
- crun is a fast, low-memory-footprint OCI container runtime written in C.Read 3 Oct 2026 · github.com
- Free plan
- YesRead 22 Sep 2026 · github.com
- Integrations
- The README documents an Ansible role for automating installation of a statically linked binary and says a Lua binding is available.Read 3 Oct 2026 · github.com
- Artifact verification
- The README says official release artifacts are signed and provides GPG commands to verify them against the repository keyring.Read 3 Oct 2026 · github.com
- Build platforms
- The README lists build instructions for Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine, and openSUSE Tumbleweed.Read 3 Oct 2026 · github.com
- cgroup limit
- The manual says cgroup v1 support is deprecated and will be removed in a future release.Read 3 Oct 2026 · github.com
- Container operations
- The command-line interface includes create, run, exec, list, pause, resume, update, checkpoint, and restore operations.Read 3 Oct 2026 · github.com
- Contributor requirements
- The contribution guide says contributors need C knowledge and a Linux environment, and requires a Developer Certificate of Origin sign-off for pull requests.Read 3 Oct 2026 · github.com
- Integration
- The README demonstrates using crun with Podman via the --runtime option.Read 3 Oct 2026 · github.com
- Library
- The project aims to make crun usable as a library for programs that manage OCI containers without an external process.Read 3 Oct 2026 · github.com
- Maintainer
- The latest release page credits Giuseppe Scrivano as the release author.Read 3 Oct 2026 · github.com
- OCI compatibility
- crun conforms to the OCI Container Runtime specifications.Read 3 Oct 2026 · github.com
- Performance
- The README reports that, on the maintainer’s machine, running 100 sequential /bin/true containers took 1.69 seconds with crun and 3.34 seconds with runc.Read 3 Oct 2026 · github.com
- Release verification
- The project says official release artifacts are signed with keys listed in crun.keyring and provides GPG verification commands.Read 3 Oct 2026 · github.com
- Releases
- The releases page lists Linux amd64 and arm64 binaries, including variants built with systemd disabled.Read 3 Oct 2026 · github.com
- Response target
- The security policy aims to acknowledge reports within 3 business days.Read 3 Oct 2026 · github.com
- Rootless use
- crun can generate a configuration file for an unprivileged user and automatically creates a user namespace when run by a non-root user.Read 3 Oct 2026 · github.com
- Security practices
- The security policy says CI runs fuzz testing with honggfuzz, AddressSanitizer runtime analysis, and clang-check and clang-format quality checks on pull requests.Read 3 Oct 2026 · github.com
- Security reporting
- The security policy directs vulnerability reports through GitHub Security Advisories rather than public issues or pull requests.Read 3 Oct 2026 · github.com
- Security response
- The project aims to acknowledge security reports within three business days and says confirmed issues are handled according to severity and impact.Read 3 Oct 2026 · github.com
- Security testing
- The security policy says the codebase is fuzz-tested with honggfuzz and checked with AddressSanitizer, clang-check, and clang-format in CI.Read 3 Oct 2026 · github.com
- Steward
- The security policy identifies Red Hat, Inc. as the project's open source software steward under the EU Cyber Resilience Act.Read 3 Oct 2026 · github.com
- Support coverage
- The project says it regularly issues patch releases for the latest version, while fixes for prior releases are best effort and not guaranteed.Read 3 Oct 2026 · github.com
- Supported versions
- The security policy says the latest version receives regular patch releases, while fixes for prior versions are best-effort and not guaranteed unless specified in a support matrix.Read 3 Oct 2026 · github.com
- Vulnerability reporting
- The security policy asks reporters to submit vulnerabilities through GitHub Security Advisories rather than public issues or pull requests.Read 3 Oct 2026 · github.com
Plans and prices
crun Free OCI container runtime · source build and release binaries Read 3 Oct 2026 · github.com
Strong points and limits
Strong points
- Conforms to OCI Container Runtime specifications.
- Supports rootless use with a user namespace.
- Offers create, run, exec, checkpoint and restore operations.
- Signed release artifacts have GPG verification instructions.
- Free plan; self-hosted on Linux.
Limits
- cgroup v1 support is deprecated.
- Prior-version fixes are best effort, not guaranteed.
- Windows containers are not supported.
Who it suits
crun suits Linux users and teams managing OCI containers who want a self-hosted runtime, including those using Podman or rootless operation. Contributors need C knowledge and a Linux environment.
Verdict
crun provides OCI-compatible container operations, including rootless use, at no listed cost. Note the deprecated cgroup v1 support and the limited guarantee for fixes to older versions.
Where Specifiction places it
- Container Runtime Software#3 of 288.6
- Container Engines#5 of 318.5
- Image Compression Software#47 of 857.9
