crun — Lightweight OCI Container Runtime Written in C

Introduction

crun is an OCI-compliant container runtime written in C, developed as part of the Red Hat containers ecosystem. It is designed to be a faster and more memory-efficient alternative to runc (which is written in Go), while maintaining full compatibility with the OCI runtime specification used by Podman, Docker, and Kubernetes.

What crun Does

• Executes OCI-compliant containers as a low-level runtime for container engines
• Starts containers faster and uses less memory than runc due to its C implementation
• Supports cgroups v2 natively including systemd cgroup driver integration
• Enables rootless container execution without requiring root privileges
• Runs WebAssembly workloads inside containers via WasmEdge and Wasmtime integration

Architecture Overview

crun implements the OCI runtime specification as a standalone C binary with minimal dependencies. When a container engine (Podman, CRI-O, containerd) invokes crun, it reads the OCI bundle's config.json, sets up Linux namespaces, cgroups, seccomp filters, and the root filesystem, then execs the container process. The C implementation avoids the Go runtime overhead (goroutine scheduler, garbage collector), resulting in a smaller binary and lower startup latency.

Self-Hosting & Configuration

• Install from package managers on Fedora, RHEL, Debian, Ubuntu, and Arch Linux
• Configure as the default runtime in Podman via containers.conf under [engine]
• Set as the CRI-O runtime by updating the crio.conf runtime handler configuration
• Use with containerd by adding a crun runtime entry in the containerd config
• Build from source with optional support for WasmEdge, Wasmtime, or libkrun for VM-isolated containers

Key Features

• Written in C with no Go runtime overhead, resulting in a ~1 MB binary
• Container startup is measurably faster than runc in benchmarks
• Native cgroups v2 support with proper systemd integration for resource management
• Experimental krun mode for running containers inside lightweight micro-VMs
• WebAssembly runtime support for running Wasm modules as OCI containers

Comparison with Similar Tools

• runc — Reference OCI runtime in Go; crun is faster and lighter as a C implementation
• youki — OCI runtime in Rust; crun has broader adoption and longer production track record
• gVisor (runsc) — Application kernel for sandboxing; crun uses standard Linux namespaces
• Kata Containers — VM-based isolation for security; crun can optionally use libkrun for similar isolation
• WasmEdge — WebAssembly runtime; crun can embed it as an alternative container execution backend

FAQ

Q: Is crun a drop-in replacement for runc? A: Yes. crun implements the same OCI runtime spec and command-line interface. You can switch by changing the runtime path in your container engine configuration.

Q: Is it used in production? A: Yes. crun is the default container runtime on Fedora and RHEL-based systems using Podman and CRI-O.

Q: How much faster is it than runc? A: Container creation is typically 40-50% faster and memory usage is significantly lower due to the absence of the Go runtime. Exact numbers vary by workload.

Q: Does it work with Kubernetes? A: Yes. crun works as a runtime for CRI-O and containerd, which are the standard container runtimes for Kubernetes.

Sources

• https://github.com/containers/crun
• https://crun.io/