opencontainers/runtime-spec

Features

• Container Deployment Standards - Provides an open specification and standardized schema for defining container configurations.
• Application Bundles - Packages application directories and configuration files into standardized bundles for execution.
• Container Runtime Managers - Organizes container configuration data and root filesystems into a standardized local directory structure so compliant runtimes can execute them consistently.
• Container Destructions - Destroys resources associated with stopped containers and releases their unique identifiers.
• Device Mounts - Mounts filesystems and exposes specific device paths with custom file modes for isolation.
• Container Filesystem Mounts - Organizes root filesystems and additional path mounts inside isolated container environments.
• Propagation Rules - Defines how mount events are shared between the host and container root filesystem.
• Low-Level Bundle Launchers - Implements low-level platform operations to launch and run container bundles according to configuration.
• Process Runtime Environment Configurations - Sets the executable arguments, environment variables, working directory, and terminal properties for the main process running inside the container.
• Container Lifecycle Management - Governs container creation, execution startup, process signaling, and resource teardown.
• Configuration Validation - Verifies container configuration and state documents against predefined structural schemas.
• Container Environment Managers - Establishes the container environment and applies configuration settings from the bundle without executing the user program.
• Container Image Layering - Specifies an ordered list of image layer folders that the container relies on, ranging from the topmost layer down to the base scratch entry.
• Running Container State Tracking - Maintains and reports running container state including operational status and identifiers.
• Container Execution - Triggers the execution of the user-specified program within a previously created container environment.
• Container Lifecycle Management - Reads configuration files to create isolated environments, execute processes inside them, and handle ongoing container operations.
• Container Lifecycle Signaling - Standardizes operations and lifecycle hooks governing container creation, execution, and teardown.
• Container Metadata Retrieval - Retrieves the current operational status and metadata of existing containers from runtime APIs.
• Container Root Filesystem Initializers - Defines the path and read-only status of the primary directory that serves as the root filesystem for the container.
• Container Runtimes - Executes standardized application bundles to run isolated containers on target operating systems.
• Cross-Infrastructure Deployments - Deploys containerized workloads consistently across diverse infrastructure environments.
• Execution Environment Configurations - Defines container configuration settings and environment parameters for consistent execution.
• Local Directory Packaging - Organizes container assets, execution binaries, and configuration files into a uniform local directory structure for cross-runtime execution.
• OCI Container Engines - Defines configuration formats and execution environments for portable, isolated container workloads.
• Container Shared Memory Adjustments - Constrains the maximum amount of shared memory that can be allocated for container usage.
• Container Domain Name Assignments - Assigns custom hostnames and domain names to isolate identification for container processes.
• Node Controls - Controls device node accessibility and file permissions within the container environment.
• Mount Propagation Control - Defines ordered storage attachments and controls how mount events are shared between the host and container root environments.
• Namespace-Based Isolation - Restricts process visibility by wrapping global operating system resources into isolated abstractions like network, mounts, and process IDs.
• Process Namespace Isolation - Applies operating system namespaces to isolate process visibility and network connectivity.
• Hardware Resource Allocation - Enforces configuration and limits for CPU, memory, and storage on isolated container workloads.
• Kernel Isolation Mechanisms - Defines operating system parameters and namespaces using native kernel isolation mechanisms.
• Process Signal Management - Triggers operating system signals to manage and terminate container processes.
• Runtime Memory Limits - Sets physical and swap memory caps to control total memory resources available to containers.
• Container CPU, Memory, and Disk Limits - Restricts the percentage of CPU time user threads can consume to prevent resource starvation.
• Lifecycle Hook Executions - Triggers external programs automatically at specific chronological stages before or after container creation, startup, and termination.
• Environment Isolation - Applies resource limits, namespaces, and custom mounts to execution environments to isolate processes.
• Container Security Profiles - Restricts container privileges and applies kernel security profiles for runtime isolation.
• Kernel Security Enforcement - Applies security profiles using kernel isolation modules to restrict container actions.
• Container Privilege Restrictions - Limits container operations by dropping or allowing specific kernel privilege flags and capabilities.
• Path Masking - Hides sensitive paths or sets directories to read-only mode inside the container.
• Execution Boundary Hardening - Restricts allowed system calls, architectures, and arguments to harden container execution boundaries against potential host exploits.
• Seccomp Profiles - Restricts allowed system calls, architectures, and arguments to harden execution boundaries.
• JSON Configuration Schemas - Defines container layout, root filesystems, and resource limits using a strictly validated JSON configuration document format.
• User Namespace Mappings - Relates host system user and security identifiers to local namespace identifiers to enforce least-privilege access control.
• User ID Mapping Configurations - Relates user and group IDs from the host system to local identifiers within the container namespace.
• Sandboxed Execution Environments - Spawns and manages isolated containerized applications using standard execution environments.
• Multi-Version Declaration Configurations - Specifies minimum and maximum recognized version bounds for configuration file validation.
• Container Cgroup Resource Limits - Controls and limits resource usage using cgroup allocation versions and manager implementations.
• Control Group Resource Limiting - Imposes hard resource caps on containers for CPU, memory, block I/O, and processes using underlying kernel subsystem metrics.
• System Execution Personalities - Sets system execution personality to control system call behaviors and compatibility flags.
• Identifier-Mapped Mounts - Enables identifier-mapped mounts with custom user and group ID mappings for shared storage volumes.
• Valid Mount Option Declarations - Lists valid mount options recognized by the runtime, including options supported across filesystems.
• Container Bridge Networks - Provisions temporary virtual network interfaces and link settings automatically upon container startup.
• VM-Like Isolation Runtimes - Enables hypervisor isolation mode with utility virtual machine images for enhanced container security.
• Network Namespace Virtualization - Transfers physical or virtual network devices into container network namespaces for connectivity.
• Service Milestone Startup Gates - Ensures service management facility milestones reach an online state before starting primary container processes.
• Container Networking Configurations - Defines network endpoints, DNS settings, and shared namespaces for container communication.
• Virtual Machine Runtimes - Defines hypervisor binaries, boot kernels, and initial ramdisks to manage container virtual machines.
• Virtual Hardware Configuration - Specifies virtual CPU counts, memory limits, and hardware passthrough parameters.
• Unsafe Annotation Prefixes - Identifies specific configuration annotation keys and prefixes that may alter runtime behavior.
• Lifecycle Hook Name Enumerations - Enumerates recognized names of lifecycle hooks supported for container execution.
• Hardware Identifier Mappings - Maps hardware device class identifiers to make specific devices available within containers.
• Container Specifications - Configures group Managed Service Accounts for containers using an implementation-defined specification.
• Allocation Policies - Defines custom memory allocation policies and flags to optimize container memory behavior.

Historial de estrellas