---
name: "runc-oci-container-runtime"
description: "Create, run, and manage standard OCI container lifecycles directly via runc CLI."
metadata:
  author: "Open Containers Initiative"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run container with runc"
  - "generate runc config spec"
  - "configure runc namespaces"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# runc Low-Level OCI Container Runtime & Spec Config

Operates runc: generating OCI config.json specs, unpacking rootfs filesystems, configuring Linux namespaces (pid, net, ipc, mnt, uts, user), cgroups limitations, and seccomp syscall filters.

## When to Invoke
Invoke this skill whenever you need to:
- run container with runc
- generate runc config spec
- configure runc namespaces

## Execution SOP & Rules
1. Create container bundle directory: mkdir -p bundle/rootfs && cd bundle.
2. Generate default OCI configuration: runc spec.
3. Modify config.json to customize process arguments, environment variables, and namespace flags.
4. Launch container instance: runc run my-container-id.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.