Crun

crun is an OCI-compliant container runtime implemented in C. It provides the low-level functionality required to create, start, pause, resume, and delete containers according to the Open Container Initiative runtime spec. Designed as a lightweight alternative to more feature-rich runtimes, crun emphasizes a small binary size, fast startup, and efficient use of system resources.

As a runtime component in container ecosystems, crun is intended to be used with higher-level container tools such as Podman and other OCI-based workflows. It supports the standard container lifecycle operations and can be configured as the default runtime in environments that rely on OCI-compatible tooling. crun aims to be compatible with various Linux kernel features and container security mechanisms, focusing on efficient use of namespaces and control groups.

Key technical aspects include support for Linux namespaces for isolation and cgroups to enforce resource limits. It provides compatibility with cgroup v2 and integrates with security features such as seccomp filtering, and, where available on the host, AppArmor or SELinux. Rootless operation is supported on systems configured with user namespaces, enabling non-privileged container runs where appropriate.

In practice, crun is used in distributions and container stacks that require a fast, memory-efficient runtime without sacrificing compatibility with the OCI specification. Its lightweight design makes it suitable for large-scale deployments and environments prioritizing startup speed and resource efficiency, while remaining interoperable with other OCI-compliant tools and runtimes. See also: runc, OCI runtime, container runtime ecosystems.