runc
containeroci-runtimeopen sourceThe standard OCI runtime: the low-level executor that assembles namespaces, cgroups, and seccomp into a running container.
runc is the OCI's own container runtime, a CLI tool for spawning and running containers on Linux according to the OCI Runtime Spec, spun out of Docker and donated to the Open Containers Initiative in 2015. Given an OCI bundle (config.json plus a rootfs) it makes the that create the container, unshares namespaces, configures cgroups, applies the seccomp profile and capability set, then execs the workload. Docker and Kubernetes create containers through it via containerd, and it runs standalone with runc run, no engine or daemon required. Hardened runtimes like gVisor's runsc and Sysbox occupy this same slot, which is why swapping them in is one line of engine config.
Strengths
- The standard OCI runtime, what Docker and Kubernetes actually create containers with
- Runs standalone: `runc run` needs no engine or daemon
- Defines the slot hardened runtimes (gVisor, Sysbox) drop into
Limitations
- Shared kernel, a plain container is not a hard security boundary
- Escape-class CVEs recur in a recognisable pattern, procfs and mount races: four in the 24 months to mid-2026, including the 2025-11-05 trio CVE-2025-52565, CVE-2025-52881, and CVE-2025-31133
- Its hardening is opt-in and easy to switch off wholesale: one Privileged:true upstream disables the seccomp profile, AppArmor, and user namespaces at once
- No images, networks, or lifecycle, that is the engine's job
- Linux only