containers/crun
Crun
crun is a low-level container runtime that implements the Open Container Initiative specification for managing the lifecycle of isolated processes. It provides the core mechanisms for container creation, execution, and deletion, ensuring compatibility across platforms through standardized lifecycle management.
The project distinguishes itself by offering a shared C library that allows container runtime operations to be embedded directly into other compiled applications. It further extends execution capabilities through specialized handlers that enable the deployment of containers within isolated microVMs or the execution of WebAssembly workloads.
The runtime covers a broad range of low-level isolation and resource management capabilities. This includes the use of namespaces and seccomp filters for security, cgroups for CPU and memory limit enforcement, and tools for saving and resuming container execution states via checkpoint and restore. It also provides interfaces for dynamic resource updates, mount management, and automation via an embedded Lua interface.
Features
- OCI Container Engines - Implements a low-level container runtime following the Open Container Initiative specification for process lifecycle management.
- OCI Runtime Implementations - Implements a low-level container runtime that adheres to the Open Container Initiative specifications.
- Container Isolation Configuration - Implements low-level isolation using Linux kernel namespaces and cgroups to secure container processes.
- Container Command Executors - Allows running new processes inside an existing container with custom environment variables and terminal allocation.
- OCI Container Process Management - Manages isolated process lifecycles and signals according to the OCI runtime specification.
- C Libraries - Exposes runtime operations as a portable C library for direct binary linking into other applications.
- Container Runtime Libraries - Ships as a shared C library that exposes container runtime operations for integration into other applications.
- Runtime API Embeddings - Exposes container runtime operations as a shared C library for seamless integration into compiled applications.
- Namespace-Based Isolation - Leverages Linux kernel namespaces to isolate container processes from the host system.
- Runtime Library Embedding - Provides a shared C library that allows container runtime operations to be embedded directly into other compiled applications.
- Process Signal Management - Sends OS-level signals to the init process or all container processes to manage termination and shutdowns.
- Library Embedding - Allows the container runtime to be integrated as a library within another application.
- Security Policy Enforcers - Applies security profiles and restricts system calls to isolate container processes from the host.
- Root Filesystem Isolation - Implements root filesystem security via symlink resolution and management of read-only paths and mount propagation.
- Seccomp Profiles - Restricts available kernel system calls by applying seccomp security profiles and raw filter data.
- Container Cgroup Resource Limits - Enforces CPU and memory limits on containers using Linux kernel control groups.
- Container Lifecycle Management - Manages the full container lifecycle, including creation, starting, pausing, resuming, and deletion.
- Container State Inspection - Provides capabilities to list known containers and output the current status of running processes.
- Control Group Resource Limiting - Controls resource allocation and limits through kernel-level control groups.
- Container State Persistence - Preserves the execution state of a running container on disk to allow resumption from that point.
- Container Checkpointing - Freezes a running container's process state to disk for later resumption.
- Wasm Execution Engines - Provides an execution layer that allows WebAssembly workloads to run as isolated processes within container environments.
- Container Directory Mounting - Provides configuration for advanced bind mount behaviors for host-to-container file sharing.
- Binary Workload Execution - Supports launching containers using alternative handlers for virtualized kernels or non-standard binary formats.
- External Workload Handlers - Implements specialized handlers to launch containers within isolated microVMs or execute WebAssembly workloads.
- Dynamic Mount Management - Allows adding or removing mount points from a running container using a structured configuration file.
- Process State Checkpointing - Saves and resumes the execution state of a running process by serializing its memory and registers to disk.
- MicroVM Runtimes - Includes specialized handlers to launch containers within isolated microVMs for enhanced security boundaries.
- MicroVM Configuration - Allows defining microVM parameters through configuration files or specific annotations within the container image.
- Virtualized Container Execution - Execution of containerized programs within isolated kernel-based virtual machine environments for enhanced security boundaries.
- Embedded Lua Scripting - Provides an embedded Lua scripting interface for automating container management tasks.
- Lua Script Execution Environments - Exposes the runtime library to Lua scripts for programmatic control of container environments.
- WebAssembly - Supports the execution of portable WebAssembly binary workloads by interfacing with compatible runtime engines.
- WebAssembly Runtimes - Interfaces with compatible runtime engines to execute portable WebAssembly binary workloads as containers.
- Dynamic Resource Updates - Enables the modification of CPU, memory, and PID limits for running containers without requiring a restart.
- Container Runtimes and Platforms - Fast, lightweight OCI runtime.
