Go to file
Michael Crosby 1865c0aac6 Remove apparmor profile generation from libcontainer
The creation of the profile should be handled outside of libcontainer so
that it can be customized and packaged.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2015-07-02 13:45:27 -07:00
Godeps Use godeps for building of vendored files 2015-06-22 09:23:17 -07:00
libcontainer Remove apparmor profile generation from libcontainer 2015-07-02 13:45:27 -07:00
.gitignore Initial commit of runc binary 2015-06-21 19:34:13 -07:00
CONTRIBUTING.md Move libcontainer documenation to root of repo 2015-06-26 11:50:46 -07:00
LICENSE Initial commit of runc binary 2015-06-21 19:34:13 -07:00
MAINTAINERS Move libcontainer documenation to root of repo 2015-06-26 11:50:46 -07:00
MAINTAINERS_GUIDE.md Move libcontainer documenation to root of repo 2015-06-26 11:50:46 -07:00
Makefile Prefer Godep dependencies in the GOPATH 2015-06-30 14:07:56 -04:00
NOTICE Move libcontainer documenation to root of repo 2015-06-26 11:50:46 -07:00
PRINCIPLES.md Move libcontainer documenation to root of repo 2015-06-26 11:50:46 -07:00
README.md README changes for the newer spec format. 2015-06-30 13:02:34 -04:00
checkpoint.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
events.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
main.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
main_unix.go Windows: Remove nsenter dependency 2015-06-28 17:04:16 -07:00
main_unsupported.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
restore.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
run.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
signals.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
spec.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
spec_linux.go Move namespaces into linux spec 2015-06-29 13:30:35 -07:00
test_Dockerfile Add makefile targets for basic lint and testing 2015-06-30 10:17:10 -07:00
tty.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00
utils.go Enable build on unsupported platforms 2015-06-29 17:03:44 -07:00

README.md

runc

runc is a CLI tool for spawning and running containers according to the OCF specification.

State of the project

Currently runc is an implementation of the OCF specification. We are currently sprinting to have a v1 of the spec out within a quick timeframe of a few weeks, ~July 2015, so the runc config format will be constantly changing until the spec is finalized. However, we encourage you to try out the tool and give feedback.

Building:

# create a 'github.com/opencontainers' in your GOPATH
cd github.com/opencontainers
git clone https://github.com/opencontainers/runc
cd runc
make
sudo make install

Using:

To run a container that you received just execute runc with the JSON format as the argument or have a config.json file in the current working directory.

runc
/ $ ps
PID   USER     COMMAND
1     daemon   sh
5     daemon   sh
/ $

OCF Container JSON Format:

Below is a sample config.json configuration file. It assumes that the file-system is found in a directory called rootfs and there is a user named daemon defined within that file-system.

{
    "version": "0.1.1",
    "platform": {
        "os": "linux",
        "arch": "amd64"
    },
    "process": {
        "terminal": true,
        "user": "daemon",
        "args": [
            "sh"
        ],
        "env": [
            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "TERM=xterm"
        ],
        "cwd": ""
    },
    "root": {
        "path": "rootfs",
        "readonly": true
    },
    "hostname": "shell",
    "mounts": [
        {
            "type": "proc",
            "source": "proc",
            "destination": "/proc",
            "options": ""
        },
        {
            "type": "tmpfs",
            "source": "tmpfs",
            "destination": "/dev",
            "options": "nosuid,strictatime,mode=755,size=65536k"
        },
        {
            "type": "devpts",
            "source": "devpts",
            "destination": "/dev/pts",
            "options": "nosuid,noexec,newinstance,ptmxmode=0666,mode=0620,gid=5"
        },
        {
            "type": "tmpfs",
            "source": "shm",
            "destination": "/dev/shm",
            "options": "nosuid,noexec,nodev,mode=1777,size=65536k"
        },
        {
            "type": "mqueue",
            "source": "mqueue",
            "destination": "/dev/mqueue",
            "options": "nosuid,noexec,nodev"
        },
        {
            "type": "sysfs",
            "source": "sysfs",
            "destination": "/sys",
            "options": "nosuid,noexec,nodev"
        }
    ],
    "linux": {
        "namespaces": [
            {
                "type": "process"
            },
            {
                "type": "network"
            },
            {
                "type": "mount"
            },
            {
                "type": "ipc"
            },
            {
                "type": "uts"
            }
        ],
        "capabilities": [
            "AUDIT_WRITE",
            "KILL",
            "NET_BIND_SERVICE"
        ],
        "devices": [
            "null",
            "random",
            "full",
            "tty",
            "zero",
            "urandom"
        ]
    }
}

Examples:

Using a Docker image (requires version 1.3 or later)

To test using Docker's busybox image follow these steps:

  • Install docker and download the busybox image: docker pull busybox
  • Create a container from that image and export its contents to a tar file: docker export $(docker create busybox) > busybox.tar
  • Untar the contents to create your filesystem directory:
mkdir rootfs
tar -C rootfs -xf busybox.tar
  • Create a file called config.json using the example from above. Modify the user property to be root.
  • Execute runc and you should be placed into a shell where you can run ps:
$ runc
/ # ps
PID   USER     COMMAND
    1 root     sh
    9 root     ps

Using runc with systemd

[Unit]
Description=Minecraft Build Server
Documentation=http://minecraft.net
After=network.target

[Service]
CPUQuota=200%
MemoryLimit=1536M
ExecStart=/usr/local/bin/runc
Restart=on-failure
WorkingDirectory=/containers/minecraftbuild

[Install]
WantedBy=multi-user.target