opencontainers/runc on Hacker News

Not to contradict anything you wrote, but if you look at the language stats for https://github.com/opencontainers/runc , it has 68.5% Go, 27.1% Shell and 3.5% C, so it's fair to say that it was "written in Go", even though the most…

comment by rob74 · 2026-10-23 · in Docker is weird

…the solution for containers is to update your seccomp policy to block the vulnerable syscall. [1]: https://github.com/opencontainers/runc/issues/1980

comment by cyphar · 2026-05-08 · in Dirty Frag: Universal Linux LPE

…untrusted image within an unprivileged container was a safe thing to do and I still believe so. [1] https://github.com/opencontainers/runc/security/advisories/G...

comment by jrpear · 2026-02-28 · in Don't trust AI agents

…But we also want to have to the frills of using GUI programs, audio, and network access. runc ( https://github.com/opencontainers/runc ) allows us to do exactly this. My config sets up a container with folders bind mounted from the host.…

comment by samlinnfer · 2026-01-19 · in Using proxies to hide secrets from Claude Code

…the latter case you have to trust the application it will actually do the appropriate locking? [0]: https://github.com/opencontainers/runc/issues/2859 [1]: https://github.com/opencontainers/runtime-spec/issues/1110

comment by codethief · 2025-11-30 · in Landlock-Ing Linux

▲ 185

LLM policy?

story by dropbox_miner · 2025-11-10 · 138 comments

…in which open source is headed. There is an issue opened now to talk about LLM Generated issues: https://github.com/opencontainers/runc/issues/4990

comment by dropbox_miner · 2025-11-10 · in Runc breaks pods when CPU requests aren't multiples of 10

Oh yay. More AI powered slop. And I do mean slop. It was fixed already: https://github.com/opencontainers/runc/pull/4751 So the bot goes ahead and spams every project that has already done the work. And unrelated ones. Whilst also leaking…

comment by shakna · 2025-11-09 · in Runc breaks pods when CPU requests aren't multiples of 10

▲ 39

Runc breaks pods when CPU requests aren't multiples of 10

story by dropbox_miner · 2025-11-09 · 12 comments

…seems to have already settled on VMs or gVisor[2] being table-stakes. We use the latter. 1. https://github.com/opencontainers/runc/security/advisories/G... 2. https://gvisor.dev/docs/architecture_guide/security/

comment by thundergolfer · 2025-09-29 · in Sandboxing AI agents at the kernel level

…the archive in OBS rather than pulling it at build time -- but it would be nice to do both). [1]: https://github.com/opencontainers/runc/blob/v1.4.0-rc.1/runc... [2]: https://github.com/opencontainers/runc/blob/v1.4.0-rc.1/scri... [3]:…

comment by cyphar · 2025-09-18 · in Tinycolor supply chain attack post-mortem

…isn't really doable without a lot of work. [1]: https://access.redhat.com/solutions/7032454 [2]: https://github.com/opencontainers/runc/issues/2128 [3]: https://www.cloudfoundry.org/blog/cve-2019-5736/ [4]:…

comment by theossuary · 2024-09-04 · in The Insecurity of Debian

…case when you are running in k8s and the last container breakout was just announced ~1 month ago: https://github.com/opencontainers/runc/security/advisories/G... . At the end of the day it is simply not a security boundary. It can solve…

comment by eyberg · 2024-03-14 · in Nanos – A Unikernel

…and then run as if it was built locally. If you have an oci bundle, you might look at runc instead: https://github.com/opencontainers/runc

comment by ttymck · 2024-02-07 · in BuildKit in depth: Docker's build engine explained

▲ 2

Several container breakouts due to internally leaked fds

story by harporoeder · 2024-02-01 · 0 comments

▲ 3

Container breakout through process.cwd trickery and leaked fds

story by todsacerdoti · 2024-01-31 · 0 comments

…), which is written in C as an alternative to runc, which is written in Go( https://github.com/opencontainers/runc )...

comment by raesene9 · 2023-09-21 · in The urgent need for memory safety in software products

…and that put an end to the tinkering. BTW, I found my hacks to make runc run on Chromebook: https://github.com/opencontainers/runc/compare/main...gabrys...

comment by Gabrys1 · 2023-08-08 · in Run Firefox on ChromeOS

…of Go avoided a bunch of the workarounds that exists in runc to workaround the Go runtime, e.g. https://github.com/opencontainers/runc/blob/main/libcontaine...

comment by gscrivano · 2023-06-05 · in Crun: Fast and lightweight OCI runtime and C library for running containers

Container volume mounting has been a source of quite a few CVEs recently. CVE-2021-30465 in runc ( https://github.com/opencontainers/runc/security/advisories/G... ) and CVE-2021-25741 in the Kubernetes kubelet (…

comment by raesene9 · 2021-12-07 · in Libcontainer: Insecure handling of bind mount sources

…was the main issue with getting Docker moved over to cgroupsv2. (Edit: some background here https://github.com/opencontainers/runc/pull/2113 ) It's fixed now though so everything should work fine with systemd. If you aren't using cgroups…

comment by md8z · 2021-10-18 · in NixOS on Framework Laptop

…If you mean the Docker registry, there are a number of alternatives, like quay.io or MCR. [1] https://github.com/opencontainers/runc#introduction [2] https://containerd.io/

comment by BossingAround · 2021-08-31 · in Ask HN: Any Good Alternative for Docker?

…additional threads. The c code to make runc work is encapsulated in libcontainer/nsenter[0] [0]: https://github.com/opencontainers/runc/tree/master/libcontai...

comment by vishvananda · 2021-02-11 · in Podman: A Daemonless Container Engine

Remember that runc contains quite a few lines of C: https://github.com/opencontainers/runc/blob/4d4d19ce528ac40c... https://github.com/opencontainers/runc/blob/4d4d19ce528ac40c...

comment by kragniz · 2021-02-11 · in Podman: A Daemonless Container Engine

The particular implementation detail I was referring to: https://github.com/opencontainers/runc/tree/master/libcontai... The distinction I was attempting to make is whether or not C source code is required in your Go project to fully…

comment by richardjennings · 2021-01-31 · in Crun: Fully featured OCI runtime and C library for running containers

…unprivileged procfs and sysfs already are there, modulo the whole mount_too_revealing thing? https://github.com/opencontainers/runc/issues/1658

comment by geofft · 2020-08-08 · in Launch HN: Nestybox (YC S20) – Containers beyond microservices

…name just the potential clash at the OS level. Because over the years, I've done it to myself. https://github.com/opencontainers/runc

comment by brudgers · 2020-06-23 · in Show HN: Runc – Compile and run C in one command

…shouldn't run it on anything that you care about :) Sometimes things are complex for a reason. [1]: https://github.com/opencontainers/runc [2]: https://golang.org/doc/go1.10#runtime [3]: https://github.com/golang/go/issues/20676 [4]:…

comment by lima · 2020-06-18 · in Gocker: Docker implemented in 1.3k lines of Go

Docker has not built support for cgroups v2 - which has been available in linux for 3 years. https://github.com/opencontainers/runc/issues/654 in order to force this issue, Fedora has made cgroups v2 as default and mandatory in the new…

comment by sandGorgon · 2019-10-22 · in The demise of Docker and the rise of Kubernetes

…-- and is the main reason why --no-pivot-root is incredibly insecure (because it uses chroot). [1]: https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libco...

comment by cyphar · 2019-09-14 · in Is chroot a security feature?

…but it wasn't possible to protect against all cases. Doing it in C was the only way to do it. [1]: https://github.com/opencontainers/runc/commit/0a8e4117e7f715...

comment by cyphar · 2019-02-12 · in CVE-2019-5736: runc container breakout

Rootless containers using user namespaces was merged into runc in March 2017: https://github.com/opencontainers/runc/pull/774 A week ago Docker gained support for running dockerd as non-root: https://github.com/moby/moby/pull/38050 And…

comment by geofft · 2019-02-12 · in CVE-2019-5736: runc container breakout

https://github.com/opencontainers/runc

comment by TurningCanadian · 2018-12-18 · in Show HN: Goldpinger – Visualize Kubernetes cluster connectivity

…to fully associate container workflows with docker itself. https://github.com/genuinetools/img + https://github.com/opencontainers/runc can be used to provide almost the same workflow as docker, without using docker itself. You could also…

comment by justinsaccount · 2018-05-16 · in Tarballs, the ultimate container image format

…process isolation on linux, LXC, then the relevant standards/tools that underly docker like runc ( https://github.com/opencontainers/runc ), you'll have a pretty deep understanding. Also, for day-to-day use, I honestly think you can do…

comment by hardwaresofton · 2018-04-03 · in A Workshop on Linux Containers: Rebuild Docker from Scratch

…either way, as Docker isn't its own "execution driver" (in Docker parlance) any more; that would be https://github.com/opencontainers/runc . But to answer the spirit your question, each container runtime uses its own peculiar combination…

comment by derefr · 2017-12-29 · in Escaping Docker container using waitid() – CVE-2017-5123

…checks. [1]: https://www.kernel.org/doc/Documentation/block/cfq-iosched.t... [2]: https://github.com/opencontainers/runc/issues/861 [3]: https://www.youtube.com/watch?v=P6Xnm0IhiSo

comment by cyphar · 2017-10-19 · in Using cgroups to limit I/O

…Go library for doing this grunt work? Of course (and you could argue that we have done that in runc with github.com/opencontainers/runc/libcontainer/nsenter), but the thing to note is that in order to get around problems in the Go runtime…

comment by cyphar · 2017-06-03 · in Linux Namespaces and Go Don't Mix

Docker uses this workaround: https://github.com/opencontainers/runc/tree/master/libcontai... "The nsenter package registers a special init constructor that is called before the Go runtime has a chance to boot." Kubernetes relies on CNI…

comment by bboreham · 2017-05-31 · in Linux Namespaces and Go Don't Mix

…https://www.cyphar.com/blog/post/rootless-containers-with-ru... [2] https://rootlesscontaine.rs/ [3] https://github.com/opencontainers/runc/pull/774 [4] https://twitter.com/lordcyphar/status/849951277744181248

comment by rektide · 2017-04-08 · in Containers and Storage: Why We Aren’t There Yet

▲ 134

Rootless containers feature merged into runC

story by marcosnils · 2017-03-27 · 39 comments

…out the RunC project if you want to know more about how the containers are run under the hood. https://github.com/opencontainers/runc

comment by alexellisuk · 2016-12-02 · in Containers but not Docker

Yes, quite literally, in fact: https://github.com/opencontainers/runc/blob/ee992e5ff7143ea3...

comment by icebraining · 2016-10-17 · in WTF is a container?

…I find the libcontainer spec [1] and runc to be way more useful than what docker has to offer. [1] https://github.com/opencontainers/runc/tree/master/libcontai...

comment by sly010 · 2016-08-15 · in A Container Is a Function Call

…you to get the same sort of unprivileged sandboxing but with a popular container runtime. [1]: https://github.com/opencontainers/runc/pull/774

comment by cyphar · 2016-08-07 · in Bubblewrap: Unprivileged sandboxing tool

…https://github.com/docker/docker/pull/15365 [2]: https://github.com/docker/docker/issues/14674 [3]: https://github.com/opencontainers/runc/pull/774

comment by cyphar · 2016-07-22 · in Docker Storage: An Introduction

…* https://github.com/docker/containerd * https://github.com/docker/notary * https://github.com/opencontainers/runc * https://github.com/docker/libnetwork * https://github.com/docker/libcompose

comment by shykes · 2016-06-09 · in SwarmKit by Docker: a toolkit to orchestrate distributed systems at any scale

…implements working rootless containers. This is really exciting. I'll be writing a blog post soon. https://github.com/opencontainers/runc/pull/774

comment by cyphar · 2016-04-23 · in Understanding and Hardening Linux Containers [pdf]

…and json config and run it. We donated it to the Linux Foundation so it's under open governance. https://github.com/opencontainers/runc

comment by shykes · 2015-11-25 · in Immutable Delivery

Btw, the container migration will be supported by runC natively: https://github.com/opencontainers/runc/tree/master/libcontai...

comment by kimh · 2015-09-22 · in Checkpoint and restore Docker containers with CRIU