runc

Spec sheet

Purpose

runc is a command-line tool for spawning and running containers on Linux according to the OCI specification.Read 8 Oct 2026 · github.com

Intended users

The project describes runc as a low-level tool mostly used by higher-level container software, and does not recommend using it directly for most users.Read 8 Oct 2026 · github.com

Integrations

The project documents using runc with Docker to prepare a root filesystem and with systemd or other process supervisors to manage containers.Read 8 Oct 2026 · github.com

License

The code and documentation are released under the Apache 2.0 license.Read 8 Oct 2026 · github.com

Build features

Build tags include seccomp syscall filtering, libpathrs path safety, and an option to disable checkpoint and restore.Read 8 Oct 2026 · github.com

Checkpoint and restore

runc supports checkpoint and restore unless built with the runc_nocriu tag, which disables that feature.Read 8 Oct 2026 · github.com

Container format

A container must be provided as an OCI bundle, and runc can generate a base configuration with its spec command.Read 8 Oct 2026 · github.com

Lifecycle

runc can run a container with one command or manage it through separate create, start, list, and delete operations.Read 8 Oct 2026 · github.com

OCI bundles

To use runc, a container must be provided in OCI bundle format.Read 8 Oct 2026 · github.com

Path safety

The libpathrs build feature provides path safety and is enabled by default in the listed build tags.Read 8 Oct 2026 · github.com

Platform limit

The project states that runc only supports Linux.Read 8 Oct 2026 · github.com

Release integrity

The project says all official releases are signed by one of the keys listed in the repository's runc.keyring file.Read 8 Oct 2026 · github.com

Release signing

The project says all official runc releases are signed by one of the keys listed in its repository keyring.Read 8 Oct 2026 · github.com

Rootless mode

runc can run containers without root privileges when user namespaces are enabled in the kernel.Read 8 Oct 2026 · github.com

Security audit

The project says a third-party security audit was performed by Cure53 and links to the report.Read 8 Oct 2026 · github.com

Security feature

The project lists seccomp syscall filtering as a build feature enabled by default, using libseccomp.Read 8 Oct 2026 · github.com

Security reporting

The OCI security policy directs vulnerability reports to [email protected] rather than GitHub issues or pull requests.Read 8 Oct 2026 · github.com

Where Specifiction places it

• Container Runtime Software#26 of 286.6
• Container Engines#29 of 316.6