crun vs firecracker-containerd

crun is a free, self-hosted OCI container runtime for Linux, written in C. It conforms to the OCI Container Runtime specifications and provides CLI operations for creating, running, executing commands in, listing, pausing, resuming, updating, checkpointing and restoring containers. It can generate a configuration for unprivileged use and creates a user namespace when run by a non-root user. The project documents integration with Podman, an Ansible role for installing a statically linked binary and a Lua binding. Build instructions cover Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine and openSUSE Tumbleweed; release binaries are listed for Linux amd64 and arm64, including variants without systemd. Official release artifacts are signed, with GPG verification commands provided. The project reports a benchmark of 100 sequential `/bin/true` containers completing in 1.69 seconds with crun versus 3.34 seconds with runc on the author's machine. The manual marks cgroup v1 support as deprecated. Regular patch releases target the latest version; fixes for earlier versions are best effort and not guaranteed.

firecracker-containerd lets containerd manage containers as Firecracker microVMs, adding isolation through the KVM hypervisor. Potential uses include sandboxing untrusted third-party containers and bin-packing different workloads on multi-tenant hosts. It uses OCI image format where possible. The project includes a control plugin and API, an out-of-process shim runtime, an agent inside the microVM, and a root filesystem image builder. That agent invokes runC through containerd-shim-runc-v1 to create Linux containers inside the microVM. Networking supports pre-created tap devices and tap devices created by CNI plugins such as bridge, ptp, host-local, firewall, and tc-redirect-tap. The software is free under Apache 2.0. Hosts require Linux 4.14 or later, Intel x86_64, and KVM; AMD and Arm are not supported. Building requires git, gcc, Docker CE, and Go 1.23 or later. The guide describes the project as very early, and multi-tenant use is at the user’s own risk.