runc

runc is a lightweight open-source container runtime that implements the Open Container Initiative (OCI) Runtime Specification. It provides the low-level primitives required to create, start, pause, resume, and delete containers on Linux, and is designed to be embedded by higher-level container engines rather than used directly by most users.

Architecturally, runc operates on a bundle directory containing a runtime configuration file (config.json) and a root filesystem (rootfs). It uses Linux namespaces to isolate the container's process tree, mount namespaces for filesystem isolation, and cgroups to constrain resources. Security features such as seccomp and Linux capabilities can be applied as part of the container's configuration. The runtime pivots into the container's root filesystem and executes the designated command as the container's init process.

Runc is the reference implementation of the OCI Runtime Specification. It originated from Docker's libcontainer project and was released as an open-source project to promote interoperability among OCI-compliant runtimes. It is maintained by the open-source community under the Open Containers Initiative and is widely used by container runtime ecosystems, including containerd and CRI-O, as the default low-level runtime in many configurations.

Because of its standardization, runc enables interoperability across runtimes and tooling, and remains a foundational component in modern container infrastructure.