With the announcement of the OCI by Solomon Hykes at last summer's DockerCon, a Docker-contributed reference implementation of the OCI spec, called runC, was born. While some of you may have tried runC or have a history of poking at the OS layer integration library to Linux namespaces, cgroups and the like (known as libcontainer), many of you may not know what runC offers. In this talk Phil Estes, Docker engine maintainer who has also contributed to libcontainer and runC, will show what's possible using runC as a lightweight and fast runtime environment to experiment with lower-level features of the container runtime. Phil will introduce a conversion tool called "riddler", which can inspect and convert container configurations from Docker into the proper OCI configuration bundle for easy conversion between the two environments. He'll also demonstrate how to make custom configurations for trying out security features like user namespaces and seccomp profiles.

1. runC: The little engine that could
(run Docker containers)
Phil Estes
IBM Cloud, Open Technology

2. About Me
2
Phil Estes
Senior Technical Staff Member
IBM Cloud, Open Technology & Strategy
@estesp
> Docker core engine maintainer
> Member of “Docker Captains” program
> 10+ years involved in Linux/OSS
Community accomplishments:
> User namespace support in the
Docker engine
> Helped design v2.2 image spec
with multi-platform support
> Implemented first tool to create
multi-platform images in Docker
v2.3 registry & DockerHub

3. What is the OCI?
(Open Container Initiative)
3

4. Open Container Initiative (OCI)
4
• A Linux Foundation Collaborative Project
• Free from control by any particular vendor’s specific cloud stack or ecosystem
• Includes:
○ container runtime specification
○ reference runtime*
○ and now, an image format specification
*seeded with runc + libcontainer by Docker

5. > Runtime specification: Release 1.0.0-rc1 / June 2016
https://github.com/opencontainers/runtime-spec/releases/tag/v1.0.0-rc1
Approaching a finalized 1.0 release (waiting on release criteria discussion)
Includes required core for containerization on Linux, Solaris, & Windows
> Image format specification: Milestone 0.3.0 / June 2016
https://github.com/opencontainers/image-spec/milestones/v0.3.0
Seeded with Docker registry v2.2 specification
Cadence of pre-releases underway in the repository:
- 0.2.0 release 3 weeks ago
- 0.3.0 targeted for this week
• Announced June
20th, 2015
• Charter signed on
December 8th, 2015
• 46 current member
companies
• Targeting a 1.0
specification
(runtime) by June
https://opencontainers.org
https://github.com/opencontainers
5
OCI: Specs and Status

6. What is `runc`?
(and how do you pronounce it?)
6

7. > runc is a client wrapper around libcontainer
> Libcontainer is the operating system interface
runC requires two pieces of information: a) an
OCI config (JSON) and b) a root filesystem
$ docker run -it --read-only -v /host:/hostpath alpine sh
/#
{
"ociVersion": "0.6.0-dev",
"platform": {
"os": "linux",
"arch": "amd64"
},
"process": {
"terminal": true,
"args": [
"sh"
],
"env": [
"PATH=/usr/local/sbin:/usr/local/bin:/bin”
config.json
7
Introduction to `runc`

8. Implement low-level container features
• Operating system level features should be defined in the OCI runtime specification
• New capabilities (PID cgroup controls, checkpoint/restore, seccomp) implemented in runC
INTEREST
INTEREST
INTEREST
1. Docker 2. OpenVZ 3. Huawei 4. Redhat 5. Google 6. IBM 7. SuSE 8. Pivotal 9. Fujitsu 10. Microsoft
Top 10 contributing companies to opencontainers/runc
OCI compliance/pluggable execution engine
• Implement a OS/environment for containers via an OCI spec compliant binary
• Examples: runz (Solaris zones), runv (hypervisor-based), Intel Clear Containers
Iterative container configuration test/debug
• Simple variant of “Docker-like” containers with less friction for quick modifications
• Low bar for dependencies: single binary + physical rootfs bundle + JSON config
8
runC: An open innovation platform

9. Let’s Demo `runc`!
# you’ll see the following tools/projects during the demo:
/usr/bin/runc https://github.com/opencontainers/runc
/usr/bin/ocitools https://github.com/opencontainers/ocitools
/usr/local/bin/riddler https://github.com/jfrazelle/riddler
/usr/local/bin/netns https://github.com/jfrazelle/netns
/usr/local/bin/uidmapshift http://bazaar.launchpad.net/~serge-hallyn/+junk/nsexec/view/head:/uidmapshift.c
9

10. 10
OCI: Futures
• Image Format Specification
– Implementation details under discussion; get involved if an area of
interest for you or your company
• More users/contributed implementations of the OCI spec(s)
• runC innovations moving up the stack
– checkpoint/restore underway (exposed via Docker engine)
– Seccomp, user namespaces, PID limits are prior examples
• What do you plan to do with OCI and/or the runC implementation?

11. Thank you!
11
@estesp
github.com/estesp
estesp@gmail.com
https://integratedcode.us
IRC: estesp