containers/crun

Features

• OCI Container Engines - Implements a low-level container runtime following the Open Container Initiative specification for process lifecycle management.
• OCI Runtime Implementations - Implements a low-level container runtime that adheres to the Open Container Initiative specifications.
• Container Isolation Configuration - Implements low-level isolation using Linux kernel namespaces and cgroups to secure container processes.
• Container Command Executors - Allows running new processes inside an existing container with custom environment variables and terminal allocation.
• OCI Container Process Management - Manages isolated process lifecycles and signals according to the OCI runtime specification.
• C Libraries - Exposes runtime operations as a portable C library for direct binary linking into other applications.
• Container Runtime Libraries - Ships as a shared C library that exposes container runtime operations for integration into other applications.
• Runtime API Embeddings - Exposes container runtime operations as a shared C library for seamless integration into compiled applications.
• Namespace-Based Isolation - Leverages Linux kernel namespaces to isolate container processes from the host system.
• Runtime Library Embedding - Provides a shared C library that allows container runtime operations to be embedded directly into other compiled applications.
• Process Signal Management - Sends OS-level signals to the init process or all container processes to manage termination and shutdowns.
• Library Embedding - Allows the container runtime to be integrated as a library within another application.
• Security Policy Enforcers - Applies security profiles and restricts system calls to isolate container processes from the host.
• Root Filesystem Isolation - Implements root filesystem security via symlink resolution and management of read-only paths and mount propagation.
• Seccomp Profiles - Restricts available kernel system calls by applying seccomp security profiles and raw filter data.
• Container Cgroup Resource Limits - Enforces CPU and memory limits on containers using Linux kernel control groups.
• Container Lifecycle Management - Manages the full container lifecycle, including creation, starting, pausing, resuming, and deletion.
• Container State Inspection - Provides capabilities to list known containers and output the current status of running processes.
• Control Group Resource Limiting - Controls resource allocation and limits through kernel-level control groups.
• Container State Persistence - Preserves the execution state of a running container on disk to allow resumption from that point.
• Container Checkpointing - Freezes a running container's process state to disk for later resumption.
• Wasm Execution Engines - Provides an execution layer that allows WebAssembly workloads to run as isolated processes within container environments.
• Container Directory Mounting - Provides configuration for advanced bind mount behaviors for host-to-container file sharing.
• Binary Workload Execution - Supports launching containers using alternative handlers for virtualized kernels or non-standard binary formats.
• External Workload Handlers - Implements specialized handlers to launch containers within isolated microVMs or execute WebAssembly workloads.
• Dynamic Mount Management - Allows adding or removing mount points from a running container using a structured configuration file.
• Process State Checkpointing - Saves and resumes the execution state of a running process by serializing its memory and registers to disk.
• MicroVM Runtimes - Includes specialized handlers to launch containers within isolated microVMs for enhanced security boundaries.
• MicroVM Configuration - Allows defining microVM parameters through configuration files or specific annotations within the container image.
• Virtualized Container Execution - Execution of containerized programs within isolated kernel-based virtual machine environments for enhanced security boundaries.
• Embedded Lua Scripting - Provides an embedded Lua scripting interface for automating container management tasks.
• Lua Script Execution Environments - Exposes the runtime library to Lua scripts for programmatic control of container environments.
• WebAssembly - Supports the execution of portable WebAssembly binary workloads by interfacing with compatible runtime engines.
• WebAssembly Runtimes - Interfaces with compatible runtime engines to execute portable WebAssembly binary workloads as containers.
• Dynamic Resource Updates - Enables the modification of CPU, memory, and PID limits for running containers without requiring a restart.
• Container Runtimes and Platforms - Fast, lightweight OCI runtime.

Star 历史