crun
crun is a free OCI container runtime written in C for Linux and self-hosted environments.
What crun is
crun is a free OCI container runtime written in C for Linux and self-hosted environments. It conforms to the OCI Container Runtime specifications and provides command-line operations for creating, running, inspecting, pausing, resuming, updating, checkpointing, and restoring containers. For unprivileged use, it can generate a configuration file and automatically creates a user namespace when run by a non-root user. The project documents use with Podman through its runtime option, an Ansible role for installing a statically linked binary, and a Lua binding. Release binaries are listed for Linux amd64 and arm64, including variants built without systemd; official artifacts are signed, with GPG verification instructions available. The project describes CI fuzz testing and code checks, and directs vulnerability reports through GitHub Security Advisories. Regular patch releases are provided for the latest version, while fixes for earlier versions are best effort and not guaranteed. The manual also notes that cgroup v1 support is deprecated and will be removed in a future release.
Good
- Conforms to OCI Container Runtime specifications
- Includes rootless operation with automatic user namespaces
- Supports container lifecycle and checkpoint operations
- Signed release artifacts have GPG verification instructions
Watch out
- Linux host support only
- cgroup v1 support is deprecated
- Fixes for prior versions are not guaranteed
Who it suits
crun suits Linux users who need an OCI-compatible runtime for self-hosted container management. It may also suit developers integrating container management into programs, since the project aims to make crun usable as a library.
Verdict
crun provides OCI-compliant container operations, including rootless use, on Linux. Consider its support policy for older releases and the planned removal of cgroup v1 support.
Plans and prices
From crun's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| crun | Free | OCI container runtime · source build and release binaries |
The facts
Each one read from crun's own pages, with the date it was checked.
What it does
- Artifact verification
- The README says official release artifacts are signed and provides GPG commands to verify them against the repository keyring.checked 3 Oct 2026
- cgroup limit
- The manual says cgroup v1 support is deprecated and will be removed in a future release.checked 3 Oct 2026
- Container operations
- The command-line interface includes create, run, exec, list, pause, resume, update, checkpoint, and restore operations.checked 3 Oct 2026
- Contributor requirements
- The contribution guide says contributors need C knowledge and a Linux environment, and requires a Developer Certificate of Origin sign-off for pull requests.checked 3 Oct 2026
- Integration
- The README demonstrates using crun with Podman via the --runtime option.checked 3 Oct 2026
- Integrations
- The README documents an Ansible role for automating installation of a statically linked binary and says a Lua binding is available.checked 3 Oct 2026
- Library
- The project aims to make crun usable as a library for programs that manage OCI containers without an external process.checked 3 Oct 2026
- Maintainer
- The latest release page credits Giuseppe Scrivano as the release author.checked 3 Oct 2026
- OCI compatibility
- crun conforms to the OCI Container Runtime specifications.checked 3 Oct 2026
- Performance
- The README reports that, on the maintainer’s machine, running 100 sequential /bin/true containers took 1.69 seconds with crun and 3.34 seconds with runc.checked 3 Oct 2026
- Product
- crun is a fast, low-memory-footprint OCI container runtime written in C.checked 3 Oct 2026
- Purpose
- crun is a fast, low-memory-footprint OCI container runtime written in C.checked 3 Oct 2026
- Releases
- The releases page lists Linux amd64 and arm64 binaries, including variants built with systemd disabled.checked 3 Oct 2026
- Release verification
- The project says official release artifacts are signed with keys listed in crun.keyring and provides GPG verification commands.checked 3 Oct 2026
- Response target
- The security policy aims to acknowledge reports within 3 business days.checked 3 Oct 2026
- Rootless use
- crun can generate a configuration file for an unprivileged user and automatically creates a user namespace when run by a non-root user.checked 3 Oct 2026
- Security practices
- The security policy says CI runs fuzz testing with honggfuzz, AddressSanitizer runtime analysis, and clang-check and clang-format quality checks on pull requests.checked 3 Oct 2026
- Security reporting
- The security policy directs vulnerability reports through GitHub Security Advisories rather than public issues or pull requests.checked 3 Oct 2026
- Security response
- The project aims to acknowledge security reports within three business days and says confirmed issues are handled according to severity and impact.checked 3 Oct 2026
- Security testing
- The security policy says the codebase is fuzz-tested with honggfuzz and checked with AddressSanitizer, clang-check, and clang-format in CI.checked 3 Oct 2026
- Steward
- The security policy identifies Red Hat, Inc. as the project's open source software steward under the EU Cyber Resilience Act.checked 3 Oct 2026
- Support coverage
- The project says it regularly issues patch releases for the latest version, while fixes for prior releases are best effort and not guaranteed.checked 3 Oct 2026
Where it runs
- Build platforms
- The README lists build instructions for Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine, and openSUSE Tumbleweed.checked 3 Oct 2026
Money
- Free plan
- Yeschecked 22 Sep 2026
Alternatives to crun
- 1
LXD
Free planWebAPILinuxSelf-hosted7.0From $25 a year - 2
BuildKit
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 3
Incus
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 4
Apptainer
Free planAPILinuxmacOSSelf-hosted6.7Free plan - 5
Buildah
Free planAPILinuxSelf-hosted6.4Free plan - 6
Podman
Free planAPILinuxmacOSSelf-hosted6.4Free plan