Provided by: crun_0.12.1+dfsg-1_amd64 
NAME
crun - a fast and lightweight OCI runtime
SYNOPSIS
crun [global options] command [command options] [arguments...]
DESCRIPTION
crun is a command line program for running Linux containers that follow the Open Container
Initiative (OCI) format.
COMMANDS
create Create a container. The runtime detaches from the container process once the
container environment is created. It is necessary to successively use start for starting
the container.
delete Remove definition for a container.
exec Exec a command in a running container.
list List known containers.
kill Send the specified signal to the container init process. If no signal is specified,
SIGTERM is used.
ps Show the processes running in a container.
run Create and immediately start a container.
spec Generate a configuration file.
start Start a container that was previously created. A container cannot be started
multiple times.
state Output the state of a container.
pause Pause all the processes in the container.
resume Resume the processes in the container.
update Update container resource constraints.
STATE
By default, when running as root user, crun saves its state under the /run/crun directory.
As unprivileged user, instead the XDG_RUNTIME_DIR environment variable is honored, and the
directory $XDG_RUNTIME_DIR/crun is used. The global option --root overrides this setting.
GLOBAL OPTIONS
--debug Produce verbose output.
--log=LOG-DESTINATION Define the destination for the error and warning messages generated
by crun. If the error happens late in the container init process, when crun already
stopped watching it, then it will be printed to the container stderr.
It is specified in the form BACKEND:SPECIFIER.
These following backends are supported:
• file:PATH
• journald:IDENTIFIER
• syslog:IDENTIFIER
If no backend is specified, then file: is used by default.
--log-format=FORMAT Define the format of the log messages. It can either be text, or
json. The default is text.
--no-pivot Use chroot(2) instead of pivot_root(2) when creating the container. This
option is not safe, and should be avoided.
--root=DIR Defines where to store the state for crun containers.
--systemd-cgroup Use systemd for configuring cgroups. If not specified, the cgroup is
created directly using the cgroupfs backend.
--cgroup-manager=MANAGER Specify what cgroup manager must be used. Permitted values are
cgroupfs, systemd and disabled.
-?, --help Print a help list.
--usage Print a short usage message.
-V, --version Print program version
CREATE OPTIONS
crun [global options] create [options] CONTAINER
--bundle=BUNDLE Path to the OCI bundle, by default it is the current directory.
--console-socket=SOCKET Path to a UNIX socket that will receive the master end of the tty
for the container.
--no-new-keyring Keep the same session key
--preserve-fds=N Additional number of FDs to pass into the container.
--pid-file=PATH Path to the file that will contain the container process PID.
RUN OPTIONS
crun [global options] run [options] CONTAINER
--bundle=BUNDLE Path to the OCI bundle, by default it is the current directory.
--console-socket=SOCKET Path to a UNIX socket that will receive the master end of the tty
for the container.
--no-new-keyring Keep the same session key.
--preserve-fds=N Additional number of FDs to pass into the container.
--pid-file=PATH Path to the file that will contain the container process PID.
--detach Detach the container process from the current session.
DELETE OPTIONS
crun [global options] delete [options] CONTAINER
--force Delete the container even if it is still running.
--regex=REGEX Delete all the containers that satisfy the specified regex.
EXEC OPTIONS
crun [global options] exec [options] CONTAINER CMD
--console-socket=SOCKET Path to a UNIX socket that will receive the master end of the tty
for the container.
--cwd=PATH Set the working directory for the process to PATH.
--cap=CAP Specify an additional capability to add to the process.
--detach Detach the container process from the current session.
--env=ENV Specify an environment variable.
--preserve-fds=N Additional number of FDs to pass into the container.
--process=FILE Path to a file containing the process JSON configuration.
--pid-file=PATH Path to the file that will contain the new process PID.
-t --tty Allocate a pseudo TTY.
-u USERSPEC --user=USERSPEC Specify the user in the form UID[:GID].
LIST OPTIONS
crun [global options] list [options]
-q --quiet Show only the container ID.
KILL OPTIONS
crun [global options] kill [options] CONTAINER SIGNAL
--all Kill all the processes in the container.
--regex=REGEX Kill all the containers that satisfy the specified regex.
PS OPTIONS
crun [global options] ps [options]
--format=FORMAT Specify the output format. It must be either table or json. By default
table is used.
SPEC OPTIONS
crun [global options] spec [options]
--rootless Generate a config.json file that is usable by an unprivileged user.
UPDATE OPTIONS
crun [global options] update [options] CONTAINER
--blkio-weight=VALUE Specifies per cgroup weight.
--cpu-period=VALUE CPU CFS period to be used for hardcapping.
--cpu-quota=VALUE** CPU CFS hardcap limit.
--cpu-rt-period=VALUE CPU realtime period to be used for hardcapping.
--cpu-rt-runtime=VALUE CPU realtime hardcap limit.
--cpu-share=VALUE CPU shares.
--cpuset-cpus=VALUE CPU(s) to use.
--cpuset-mems=VALUE Memory node(s) to use.
--kernel-memory=VALUE Kernel memory limit.
--kernel-memory-tcp=VALUE Kernel memory limit for TCP buffer.
--memory=VALUE Memory limit.
--memory-reservation=VALUE Memory reservation or soft_limit.
--memory-swap=VALUE Total memory usage.
--pids-limit=VALUE Maximum number of pids allowed in the container.
-r, --resources=FILE Path to the file containing the resources to update.
Extensions to OCI
run.oci.seccomp_fail_unknown_syscall=1
If the annotation run.oci.seccomp_fail_unknown_syscall is present, then crun will fail
when an unknown syscall is encountered in the seccomp configuration.
run.oci.keep_original_groups=1
If the annotation run.oci.keep_original_groups is present, then crun will skip the
setgroups syscall that is used to either set the additional groups specified in the OCI
configuration, or to reset the list of additional groups if none is specified.
tmpcopyup mount options
If the tmpcopyup option is specified for a tmpfs, then the path that is shadowed by the
tmpfs mount is recursively copied up to the tmpfs itself.
Automatically create user namespace
When running as user different than root, an user namespace is automatically created even
if it is not specified in the config file. The current user is mapped to the ID 0 in the
container, and any additional id specified in the files /etc/subuid and /etc/subgid is
automatically added starting with ID 1.
CGROUP v2
crun has some basic support for cgroup v2. Since the OCI spec is designed for cgroup v1,
in some cases there is need to convert from the cgroup v1 configuration to cgroup v2.
These are the OCI resources currently supported with cgroup v2 and how they are converted
when needed from the cgroup v1 configuration.
Memory controller
┌────────────┬────────────────────┬────────────┬─────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├────────────┼────────────────────┼────────────┼─────────┤
│limit │ memory.max │ y = x │ │
├────────────┼────────────────────┼────────────┼─────────┤
│swap │ memory.swap_max │ y = x │ │
├────────────┼────────────────────┼────────────┼─────────┤
│reservation │ memory.low │ y = x │ │
└────────────┴────────────────────┴────────────┴─────────┘
PIDs controller
┌────────┬────────────────────┬────────────┬─────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├────────┼────────────────────┼────────────┼─────────┤
│limit │ pids.max │ y = x │ │
└────────┴────────────────────┴────────────┴─────────┘
CPU controller
┌────────┬────────────────────┬─────────────────────┬─────────────────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├────────┼────────────────────┼─────────────────────┼─────────────────────┤
│shares │ cpu.weight │ y = (1 + ((x - 2) * │ convert from │
│ │ │ 9999) / 262142) │ [2-262144] to │
│ │ │ │ [1-10000] │
├────────┼────────────────────┼─────────────────────┼─────────────────────┤
│period │ cpu.max │ y = x │ period and quota │
│ │ │ │ are written │
│ │ │ │ together │
├────────┼────────────────────┼─────────────────────┼─────────────────────┤
│quota │ cpu.max │ y = x │ period and quota │
│ │ │ │ are written │
│ │ │ │ together │
└────────┴────────────────────┴─────────────────────┴─────────────────────┘
blkio controller
┌──────────────┬────────────────────┬─────────────────────┬─────────────────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│weight │ io.bfq.weight │ y = (1 + (x - 10) * │ convert linearly │
│ │ │ 9999 / 990) │ from [10-1000] to │
│ │ │ │ [1-10000] │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│weight_device │ io.bfq.weight │ y = (1 + (x - 10) * │ convert linearly │
│ │ │ 9999 / 990) │ from [10-1000] to │
│ │ │ │ [1-10000] │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│rbps │ io.max │ y=x │ │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│wbps │ io.max │ y=x │ │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│riops │ io.max │ y=x │ │
├──────────────┼────────────────────┼─────────────────────┼─────────────────────┤
│wiops │ io.max │ y=x │ │
└──────────────┴────────────────────┴─────────────────────┴─────────────────────┘
cpuset controller
┌────────┬────────────────────┬────────────┬─────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├────────┼────────────────────┼────────────┼─────────┤
│cpus │ cpuset.cpus │ y = x │ │
├────────┼────────────────────┼────────────┼─────────┤
│mems │ cpuset.mems │ y = x │ │
└────────┴────────────────────┴────────────┴─────────┘
hugetlb controller
┌───────────────────────────┬─────────────────────────┬────────────┬─────────┐
│OCI (x) │ cgroup 2 value (y) │ conversion │ comment │
├───────────────────────────┼─────────────────────────┼────────────┼─────────┤
│<PAGE_SIZE>.limit_in_bytes │ hugetlb.<PAGE_SIZE>.max │ y = x │ │
└───────────────────────────┴─────────────────────────┴────────────┴─────────┘
User Commands crun(1)