runc
A low-level container runtime conforming to the OCI specification, responsible for actually creating and running container processes. It provides complete container isolation by combining Linux kernel features such as Namespaces, Cgroups, and pivot_root.
Timeline (last 90 days)
runc is the reference implementation of the OCI Runtime Spec, and containerd and CRI-O wrap image management and lifecycle management capabilities on top of it.
runc uses pivot_root in combination with a Mount Namespace and executes umount2(old_root, MNT_DETACH) to completely sever the connection to the host machine's mount tree.
Docker was once affected by the runc vulnerability CVE-2019-5736, which allowed processes inside a container to overwrite the host's runc binary and obtain root privileges.
The CVE-2024-21626 vulnerability exploited a file descriptor leak in runc when handling working directories to achieve container escape, and emerged in early 2024.
Docker's underlying runtime has migrated from the original LXC to its self-developed containerd and runc
Known paths for sandbox escape include technical means such as exploiting container runtime vulnerabilities (e.g., runc CVE-2024-21626) and breaking through Linux namespace isolation.
2019 年的 CVE-2019-5736 runc 漏洞证明了共享内核隔离模型的固有安全风险
Docker底层依赖containerd作为高级运行时，再由containerd调用runc完成容器创建
runc源自Docker早期的libcontainer库，后被捐赠给OCI作为参考实现
现代容器运行时分为高级运行时（如containerd、CRI-O）和低级运行时（如runc）两层
2 more timeline events
All Facts (12)
runc is the reference implementation of the OCI Runtime Spec, and containerd and CRI-O wrap image management and lifecycle management capabilities on top of it.
50%Unverifiedrunc uses pivot_root in combination with a Mount Namespace and executes umount2(old_root, MNT_DETACH) to completely sever the connection to the host machine's mount tree.
50%UnverifiedDocker was once affected by the runc vulnerability CVE-2019-5736, which allowed processes inside a container to overwrite the host's runc binary and obtain root privileges.
50%UnverifiedDocker's underlying runtime has migrated from the original LXC to its self-developed containerd and runc
50%UnverifiedKnown paths for sandbox escape include technical means such as exploiting container runtime vulnerabilities (e.g., runc CVE-2024-21626) and breaking through Linux namespace isolation.
50%Unverified2019 年的 CVE-2019-5736 runc 漏洞证明了共享内核隔离模型的固有安全风险
50%UnverifiedDocker底层依赖containerd作为高级运行时，再由containerd调用runc完成容器创建
50%Unverifiedrunc源自Docker早期的libcontainer库，后被捐赠给OCI作为参考实现
50%Unverified现代容器运行时分为高级运行时（如containerd、CRI-O）和低级运行时（如runc）两层
50%Unverified容器运行时通常分为高级运行时（如containerd、CRI-O）和低级运行时（如runc）两层，低级运行时直接调用Linux内核的namespace和cgroup机制实现进程隔离和资源限制
50%Unverifiedrunc本身约10MB，containerd约50MB，完整的Docker引擎超过200MB
50%UnverifiedThe CVE-2024-21626 vulnerability exploited a file descriptor leak in runc when handling working directories to achieve container escape, and emerged in early 2024.
60%