File: crun.1

package info (click to toggle)
crun 0.15+dfsg-1
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, sid
  • size: 5,164 kB
  • sloc: ansic: 35,259; python: 4,924; sh: 4,833; makefile: 269
file content (558 lines) | stat: -rw-r--r-- 12,748 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
.nh
.TH crun 1 "User Commands"

.SH NAME
.PP
crun \- a fast and lightweight OCI runtime


.SH SYNOPSIS
.PP
crun [global options] command [command options] [arguments...]


.SH DESCRIPTION
.PP
crun is a command line program for running Linux containers that
follow the Open Container Initiative (OCI) format.


.SH COMMANDS
.PP
\fBcreate\fP
Create a container.  The runtime detaches from the container process
once the container environment is created.  It is necessary to
successively use \fB\fCstart\fR for starting the container.

.PP
\fBdelete\fP
Remove definition for a container.

.PP
\fBexec\fP
Exec a command in a running container.

.PP
\fBlist\fP
List known containers.

.PP
\fBkill\fP
Send the specified signal to the container init process.  If no signal
is specified, SIGTERM is used.

.PP
\fBps\fP
Show the processes running in a container.

.PP
\fBrun\fP
Create and immediately start a container.

.PP
\fBspec\fP
Generate a configuration file.

.PP
\fBstart\fP
Start a container that was previously created.  A container cannot be
started multiple times.

.PP
\fBstate\fP
Output the state of a container.

.PP
\fBpause\fP
Pause all the processes in the container.

.PP
\fBresume\fP
Resume the processes in the container.

.PP
\fBupdate\fP
Update container resource constraints.


.SH STATE
.PP
By default, when running as root user, crun saves its state under the
\fB/run/crun\fP directory.  As unprivileged user, instead the
\fIXDG\_RUNTIME\_DIR\fP environment variable is honored, and the directory
\fB$XDG\_RUNTIME\_DIR/crun\fP is used.  The global option \fB\-\-root\fP
overrides this setting.


.SH GLOBAL OPTIONS
.PP
\fB\-\-debug\fP
Produce verbose output.

.PP
\fB\-\-log\fP=\fBLOG\-DESTINATION\fP
Define the destination for the error and warning messages generated by
crun.
If the error happens late in the container init process, when crun
already stopped watching it, then it will be printed to the container
stderr.

.PP
It is specified in the form \fIBACKEND:SPECIFIER\fP\&.

.PP
These following backends are supported:

.RS
.IP \(bu 2
file:PATH
.IP \(bu 2
journald:IDENTIFIER
.IP \(bu 2
syslog:IDENTIFIER

.RE

.PP
If no backend is specified, then \fIfile:\fP is used by default.

.PP
\fB\-\-log\-format\fP=\fBFORMAT\fP
Define the format of the log messages.  It can either be \fBtext\fP, or
\fBjson\fP\&.  The default is \fBtext\fP\&.

.PP
\fB\-\-no\-pivot\fP
Use \fB\fCchroot(2)\fR instead of \fB\fCpivot\_root(2)\fR when creating the container.
This option is not safe, and should be avoided.

.PP
\fB\-\-root\fP=\fBDIR\fP
Defines where to store the state for crun containers.

.PP
\fB\-\-systemd\-cgroup\fP
Use systemd for configuring cgroups.  If not specified, the cgroup is
created directly using the cgroupfs backend.

.PP
\fB\-\-cgroup\-manager=MANAGER\fP
Specify what cgroup manager must be used.  Permitted values are \fBcgroupfs\fP,
\fBsystemd\fP and \fBdisabled\fP\&.

.PP
\fB\-?\fP, \fB\-\-help\fP
Print a help list.

.PP
\fB\-\-usage\fP
Print a short usage message.

.PP
\fB\-V\fP, \fB\-\-version\fP
Print program version

.SH CREATE OPTIONS
.PP
crun [global options] create [options] CONTAINER

.PP
\fB\-\-bundle\fP=\fBBUNDLE\fP
Path to the OCI bundle, by default it is the current directory.

.PP
\fB\-\-config\fP=\fBFILE\fP
Override the configuration file to use.  The default value is \fBconfig.json\fP\&.

.PP
\fB\-\-console\-socket\fP=\fBSOCKET\fP
Path to a UNIX socket that will receive the ptmx end of the tty for
the container.

.PP
\fB\-\-no\-new\-keyring\fP
Keep the same session key

.PP
\fB\-\-preserve\-fds\fP=\fBN\fP
Additional number of FDs to pass into the container.

.PP
\fB\-\-pid\-file\fP=\fBPATH\fP
Path to the file that will contain the container process PID.

.SH RUN OPTIONS
.PP
crun [global options] run [options] CONTAINER

.PP
\fB\-\-bundle\fP=\fBBUNDLE\fP
Path to the OCI bundle, by default it is the current directory.

.PP
\fB\-\-config\fP=\fBFILE\fP
Override the configuration file to use.  The default value is \fBconfig.json\fP\&.

.PP
\fB\-\-console\-socket\fP=\fBSOCKET\fP
Path to a UNIX socket that will receive the ptmx end of the tty for
the container.

.PP
\fB\-\-no\-new\-keyring\fP
Keep the same session key.

.PP
\fB\-\-preserve\-fds\fP=\fBN\fP
Additional number of FDs to pass into the container.

.PP
\fB\-\-pid\-file\fP=\fBPATH\fP
Path to the file that will contain the container process PID.

.PP
\fB\-\-detach\fP
Detach the container process from the current session.

.SH DELETE OPTIONS
.PP
crun [global options] delete [options] CONTAINER

.PP
\fB\-\-force\fP
Delete the container even if it is still running.

.PP
\fB\-\-regex\fP=\fBREGEX\fP
Delete all the containers that satisfy the specified regex.

.SH EXEC OPTIONS
.PP
crun [global options] exec [options] CONTAINER CMD

.PP
\fB\-\-console\-socket\fP=\fBSOCKET\fP
Path to a UNIX socket that will receive the ptmx end of the tty for
the container.

.PP
\fB\-\-cwd\fP=\fBPATH\fP
Set the working directory for the process to PATH.

.PP
\fB\-\-cap\fP=\fBCAP\fP
Specify an additional capability to add to the process.

.PP
\fB\-\-detach\fP
Detach the container process from the current session.

.PP
\fB\-\-env\fP=\fBENV\fP
Specify an environment variable.

.PP
\fB\-\-preserve\-fds\fP=\fBN\fP
Additional number of FDs to pass into the container.

.PP
\fB\-\-process\fP=\fBFILE\fP
Path to a file containing the process JSON configuration.

.PP
\fB\-\-pid\-file\fP=\fBPATH\fP
Path to the file that will contain the new process PID.

.PP
\fB\-t\fP \fB\-\-tty\fP
Allocate a pseudo TTY.

.PP
\fB\-u USERSPEC\fP \fB\-\-user\fP=\fBUSERSPEC\fP
Specify the user in the form UID[:GID].

.SH LIST OPTIONS
.PP
crun [global options] list [options]

.PP
\fB\-q\fP \fB\-\-quiet\fP
Show only the container ID.

.SH KILL OPTIONS
.PP
crun [global options] kill [options] CONTAINER SIGNAL

.PP
\fB\-\-all\fP
Kill all the processes in the container.

.PP
\fB\-\-regex\fP=\fBREGEX\fP
Kill all the containers that satisfy the specified regex.

.SH PS OPTIONS
.PP
crun [global options] ps [options]

.PP
\fB\-\-format=FORMAT\fP
Specify the output format.  It must be either \fB\fCtable\fR or \fB\fCjson\fR\&.
By default \fB\fCtable\fR is used.

.SH SPEC OPTIONS
.PP
crun [global options] spec [options]

.PP
\fB\-\-rootless\fP
Generate a config.json file that is usable by an unprivileged user.

.SH UPDATE OPTIONS
.PP
crun [global options] update [options] CONTAINER

.PP
\fB\-\-blkio\-weight\fP=\fBVALUE\fP
Specifies per cgroup weight.

.PP
\fB\-\-cpu\-period\fP=\fBVALUE\fP
CPU CFS period to be used for hardcapping.

.PP
\-\-cpu\-quota\fB=\fPVALUE**
CPU CFS hardcap limit.

.PP
\fB\-\-cpu\-rt\-period\fP=\fBVALUE\fP
CPU realtime period to be used for hardcapping.

.PP
\fB\-\-cpu\-rt\-runtime\fP=\fBVALUE\fP
CPU realtime hardcap limit.

.PP
\fB\-\-cpu\-share\fP=\fBVALUE\fP
CPU shares.

.PP
\fB\-\-cpuset\-cpus\fP=\fBVALUE\fP
CPU(s) to use.

.PP
\fB\-\-cpuset\-mems\fP=\fBVALUE\fP
Memory node(s) to use.

.PP
\fB\-\-kernel\-memory\fP=\fBVALUE\fP
Kernel memory limit.

.PP
\fB\-\-kernel\-memory\-tcp\fP=\fBVALUE\fP
Kernel memory limit for TCP buffer.

.PP
\fB\-\-memory\fP=\fBVALUE\fP
Memory limit.

.PP
\fB\-\-memory\-reservation\fP=\fBVALUE\fP
Memory reservation or soft\_limit.

.PP
\fB\-\-memory\-swap\fP=\fBVALUE\fP
Total memory usage.

.PP
\fB\-\-pids\-limit\fP=\fBVALUE\fP
Maximum number of pids allowed in the container.

.PP
\fB\-r\fP, \fB\-\-resources\fP=\fBFILE\fP
Path to the file containing the resources to update.


.SH Extensions to OCI
.SH \fB\fCrun.oci.seccomp.receiver=PATH\fR
.PP
If the annotation \fB\fCrun.oci.seccomp.receiver=PATH\fR is specified, the
seccomp listener is sent to the UNIX socket listening on the specified
path.  It can also set with the \fB\fCRUN\_OCI\_SECCOMP\_RECEIVER\fR environment variable.
It is an experimental feature, and the annotation will be removed once
it is supported in the OCI runtime specs.  It must be an absolute path.

.SH \fB\fCrun.oci.seccomp.plugins=PATH\fR
.PP
If the annotation \fB\fCrun.oci.seccomp.plugins=PLUGIN1[:PLUGIN2]...\fR is specified, the
seccomp listener fd is handled through the specified plugins.  The
plugin must either be an absolute path or a filename.

.SH \fB\fCrun.oci.seccomp\_fail\_unknown\_syscall=1\fR
.PP
If the annotation \fB\fCrun.oci.seccomp\_fail\_unknown\_syscall\fR is present, then crun
will fail when an unknown syscall is encountered in the seccomp configuration.

.SH \fB\fCrun.oci.keep\_original\_groups=1\fR
.PP
If the annotation \fB\fCrun.oci.keep\_original\_groups\fR is present, then crun
will skip the \fB\fCsetgroups\fR syscall that is used to either set the
additional groups specified in the OCI configuration, or to reset the
list of additional groups if none is specified.

.SH \fB\fCrun.oci.systemd.force\_cgroup\_v1=/PATH\fR
.PP
If the annotation \fB\fCrun.oci.systemd.force\_cgroup\_v1=/PATH\fR is present, then crun
will override the specified mount point \fB\fC/PATH\fR with a cgroup v1 mount
made of a single hierarchy \fB\fCnone,name=systemd\fR\&.
It is useful to run on a cgroup v2 system containers using older
versions of systemd that lack support for cgroup v2.

.SH \fB\fCrun.oci.timens\_offset=ID SEC NSEC\fR
.PP
Specify the offset to be written to /proc/self/timens\_offsets when creating
a time namespace.

.SH \fB\fCrun.oci.systemd.subgroup=SUBGROUP\fR
.PP
Override the name for the systemd sub cgroup created under the systemd
scope, so the final cgroup will be like:

.PP
.RS

.nf
/sys/fs/cgroup/$PATH/$SUBGROUP

.fi
.RE

.PP
When it is set to the empty string, a sub cgroup is not created.

.PP
If not specified, it defaults to \fB\fCcontainer\fR on cgroup v2, and to \fB\fC""\fR
on cgroup v1.

.PP
e.g.

.PP
.RS

.nf
/sys/fs/cgroup//system.slice/foo\-352700.scope/container

.fi
.RE

.SH \fB\fCrun.oci.hooks.stdout=FILE\fR
.PP
If the annotation \fB\fCrun.oci.hooks.stdout\fR is present, then crun
will open the specified file and use it as the stdout for the hook
processes.  The file is opened in append mode and it is created if it
doesn't already exist.

.SH \fB\fCrun.oci.hooks.stderr=FILE\fR
.PP
If the annotation \fB\fCrun.oci.hooks.stderr\fR is present, then crun
will open the specified file and use it as the stderr for the hook
processes.  The file is opened in append mode and it is created if it
doesn't already exist.

.SH tmpcopyup mount options
.PP
If the \fB\fCtmpcopyup\fR option is specified for a tmpfs, then the path that
is shadowed by the tmpfs mount is recursively copied up to the tmpfs
itself.

.SH Automatically create user namespace
.PP
When running as user different than root, an user namespace is
automatically created even if it is not specified in the config file.
The current user is mapped to the ID 0 in the container, and any
additional id specified in the files \fB\fC/etc/subuid\fR and \fB\fC/etc/subgid\fR
is automatically added starting with ID 1.


.SH CGROUP v2
.PP
crun has some basic support for cgroup v2.  Since the OCI spec is
designed for cgroup v1, in some cases there is need to convert from
the cgroup v1 configuration to cgroup v2.

.PP
These are the OCI resources currently supported with cgroup v2 and how
they are converted when needed from the cgroup v1 configuration.

.SH Memory controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
limit	memory.max	y = x	swap	memory.swap\_max	y = x	reservation	memory.low	y = x	.TE

.SH PIDs controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
limit	pids.max	y = x	.TE

.SH CPU controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
shares	cpu.weight	T{
y = (1 + ((x \- 2) * 9999) / 262142)
T}
	T{
convert from [2\-262144] to [1\-10000]
T}
period	cpu.max	y = x	T{
period and quota are written together
T}
quota	cpu.max	y = x	T{
period and quota are written together
T}
.TE

.SH blkio controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
weight	io.bfq.weight	T{
y = (1 + (x \- 10) * 9999 / 990)
T}
	T{
convert linearly from [10\-1000] to [1\-10000]
T}
weight\_device	io.bfq.weight	T{
y = (1 + (x \- 10) * 9999 / 990)
T}
	T{
convert linearly from [10\-1000] to [1\-10000]
T}
rbps	io.max	y=x	wbps	io.max	y=x	riops	io.max	y=x	wiops	io.max	y=x	.TE

.SH cpuset controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
cpus	cpuset.cpus	y = x	mems	cpuset.mems	y = x	.TE

.SH hugetlb controller
.TS
allbox;
l l l l 
l l l l .
\fB\fCOCI (x)\fR	\fB\fCcgroup 2 value (y)\fR	\fB\fCconversion\fR	\fB\fCcomment\fR
\&.limit\_\&in\_\&bytes	hugetlb.\&.max	y = x	.TE