Chapter 6. Selecting a container runtime The runc and crun are container runtimes and can be used interchangeably as both implement the OCI runtime specification. The crun container runtime has a couple of advantages over runc, as it is faster and requires less memory. Due to that, the crun container runtime is the recommended container runtime for use. 6.1. The runc container runtime The runc container runtime is a lightweight, portable implementation of the Open Container Initiative (OCI) container runtime specification. The runc runtime shares a lot of low-level code with Docker but it is not dependent on any of the components of the Docker platform. The runc supports Linux namespaces, live migration, and has portable performance profiles. It also provides full support for Linux security features such as SELinux, control groups (cgroups), seccomp, and others. You can build and run images with runc, or you can run OCI-compatible images with runc. 6.2. The crun container runtime The crun is a fast and low-memory footprint OCI container runtime written in C. The crun binary is up to 50 times smaller and up to twice as fast as the runc binary. Using crun, you can also set a minimal number of processes when running your container. The crun runtime also supports OCI hooks. Additional features of crun include: Sharing files by group for rootless containers Controlling the stdout and stderr of OCI hooks Running older versions of systemd on cgroup v2 A C library that is used by other programs Extensibility Portability Additional resources An introduction to crun, a fast and low-memory footprint container runtime 6.3. Running containers with runc and crun With runc or crun, containers are configured using bundles. A bundle for a container is a directory that includes a specification file named config.json and a root filesystem. The root filesystem contains the contents of the container. Note The <runtime> can be crun or runc. Prerequisites The container-tools meta-package is installed. Procedure Pull the registry.access.redhat.com/ubi9/ubi container image: Export the registry.access.redhat.com/ubi9/ubi image to the rhel.tar archive: Create the bundle/rootfs directory: Extract the rhel.tar archive into the bundle/rootfs directory: Create a new specification file named config.json for the bundle: The -b option specifies the bundle directory. The default value is the current directory. Optional: Change the settings: Create an instance of a container named myubi for a bundle: Start a myubi container: Note The name of a container instance must be unique to the host. To start a new instance of a container: # <runtime> start <container_name> Verification List containers started by <runtime> : Additional resources crun and runc man pages on your system An introduction to crun, a fast and low-memory footprint container runtime 6.4. Temporarily changing the container runtime You can use the podman run command with the --runtime option to change the container runtime. Note The <runtime> can be crun or runc. Prerequisites The container-tools meta-package is installed. Procedure Pull the registry.access.redhat.com/ubi9/ubi container image: Change the container runtime using the --runtime option: Optional: List all images: Verification Ensure that the OCI runtime is set to <runtime> in the myubi container: Additional resources An introduction to crun, a fast and low-memory footprint container runtime 6.5. Permanently changing the container runtime You can set the container runtime and its options in the /etc/containers/containers.conf configuration file as a root user or in the USDHOME/.config/containers/containers.conf configuration file as a non-root user. Note The <runtime> can be crun or runc runtime. Prerequisites The container-tools meta-package is installed. Procedure Change the runtime in the /etc/containers/containers.conf file: Run the container named myubi: Verification Ensure that the OCI runtime is set to <runtime> in the myubi container: Additional resources An introduction to crun, a fast and low-memory footprint container runtime containers.conf man page on your system

Commands:
podman pull registry.access.redhat.com/ubi9/ubi
podman export USD(podman create registry.access.redhat.com/ubi9/ubi) > rhel.tar
mkdir -p bundle/rootfs
tar -C bundle/rootfs -xf rhel.tar
<runtime> spec -b bundle
vi bundle/config.json
<runtime> create -b bundle/ myubi
<runtime> start myubi
<runtime> list ID PID STATUS BUNDLE CREATED OWNER myubi 0 stopped /root/bundle 2021-09-14T09:52:26.659714605Z root
podman pull registry.access.redhat.com/ubi9/ubi
podman run --name=myubi -dt --runtime=<runtime> ubi9 e4654eb4df12ac031f1d0f2657dc4ae6ff8eb0085bf114623b66cc664072e69b
podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES e4654eb4df12 registry.access.redhat.com/ubi9:latest bash 4 seconds ago Up 4 seconds ago myubi
podman inspect myubi --format "{{.OCIRuntime}}" <runtime>
vim /etc/containers/containers.conf [engine] runtime = " <runtime> "
podman run --name=myubi -dt ubi9 bash Resolved "ubi9" as an alias (/etc/containers/registries.conf.d/001-rhel-shortnames.conf) Trying to pull registry.access.redhat.com/ubi9:latest... Storing signatures
podman inspect myubi --format "{{.OCIRuntime}}" <runtime>