runc

# runc

[![Go Reference](https://pkg.go.dev/badge/github.com/opencontainers/runc.svg)](https://pkg.go.dev/github.com/opencontainers/runc)
[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/588/badge)](https://bestpractices.coreinfrastructure.org/projects/588)
[![gha/validate](https://github.com/opencontainers/runc/workflows/validate/badge.svg)](https://github.com/opencontainers/runc/actions?query=workflow%3Avalidate)
[![gha/ci](https://github.com/opencontainers/runc/workflows/ci/badge.svg)](https://github.com/opencontainers/runc/actions?query=workflow%3Aci)

## Introduction

`runc` is a CLI tool for spawning and running containers on Linux according to the OCI specification.

## Releases

You can find official releases of `runc` on the [release](https://github.com/opencontainers/runc/releases) page.

All releases are signed by one of the keys listed in the [`runc.keyring` file in the root of this repository](runc.keyring).

## Security

The reporting process and disclosure communications are outlined [here](https://github.com/opencontainers/org/blob/main/SECURITY.md).

### Security Audit
A third party security audit was performed by Cure53, you can see the full report [here](https://github.com/opencontainers/runc/blob/main/docs/Security-Audit.pdf).

## Building

`runc` only supports Linux. See the header of [`go.mod`](./go.mod) for the minimally required Go version.

### Pre-Requisites

#### Utilities and Libraries

In addition to Go, building `runc` requires multiple utilities and libraries to be installed on your system.

On Ubuntu/Debian, you can install the required dependencies with:

```bash
apt update && apt install -y make gcc linux-libc-dev libseccomp-dev pkg-config git
```

On CentOS/Fedora, you can install the required dependencies with:

```bash
yum install -y make gcc kernel-headers libseccomp-devel pkg-config git
```

On Alpine Linux, you can install the required dependencies with:

```bash
apk --update add bash make gcc libseccomp-dev musl-dev linux-headers git
```

The following dependencies are optional:

* `libseccomp` - only required if you enable seccomp support; to disable, see [Build Tags](#build-tags).
* `libpathrs` - only required if you enable libpathrs support; to disable, see [Build Tags](#build-tags).
   For notes on installing libpathrs, see [the next section](#libpathrs).

##### libpathrs

[libpathrs][] is a Rust library runc can optionally use for path safety. As
mentioned in [the build tag section](#build-tags), its use is controlled with
the `libpathrs` build tag. runc currently requires *at least libpathrs 0.2.5*
in order to function properly.

At time of writing, very few distributions have libpathrs packages and so it is
usually necessary to build and install it locally. For detailed installation
instructions, see [the upstream documentation][libpathrs-install-md], but for
development builds the following instructions should be sufficient:

libpathrs requires Rust 1.63+ (which is avail