The OCI Runtime Specification defines the configuration, execution environment and lifecycle of a container — what a runtime is handed and what operations it must support — so that runc, crun, and other runtimes are interchangeable.
OCI Runtime Specification
The OCI Runtime Specification describes what happens after an image is unpacked. It defines the on-disk bundle a runtime is handed, the config.json that specifies namespaces, mounts, cgroups, capabilities and process settings, and the lifecycle operations — create, start, kill, delete — that every compliant runtime must implement.
- The bundle - A root filesystem plus a
config.json, which together are everything a runtime needs. - Platform configuration - Linux namespaces, cgroups, seccomp, capabilities and device access, expressed as data.
- Lifecycle operations - A defined state machine, which is why
runcandcruncan be swapped underneath the same orchestrator. - JSON Schema - The configuration is machine-checkable.
The runtime spec is where a container’s security posture is actually written down, and it is worth reading if you care about the blast radius of an API workload: dropped capabilities, a read-only root, and a seccomp profile are all config.json fields. That makes it the enforcement layer beneath the identity story in SPIFFE and the provenance story in SLSA. Companions: OCI Image and OCI Distribution.
