The Complete Production SOP: How to Deploy and Run runc Low-Level OCI Container Runtime & Spec Config in Autonomous AI Agents

---
name: "runc-oci-container-runtime"
description: "Create, run, and manage standard OCI container lifecycles directly via runc CLI."
metadata:
  author: "Open Containers Initiative"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run container with runc"
  - "generate runc config spec"
  - "configure runc namespaces"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: false
---

{
  "ociVersion": "1.0.2",
  "process": {
    "terminal": true,
    "user": {
      "uid": 0,
      "gid": 0
    },
    "args": [
      "sh"
    ],
    "env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "TERM=xterm"
    ],
    "cwd": "/"
  },
  "root": {
    "path": "rootfs",
    "readonly": true
  },
  "hostname": "runc-agent-box"
}

#!/usr/bin/env bash
set -euo pipefail

BUNDLE_DIR="container-bundle"
if [ ! -d "$BUNDLE_DIR/rootfs/bin" ]; then
  echo "Extracting minimal rootfs..."
  tar -xzf /tmp/alpine-minirootfs.tar.gz -C "$BUNDLE_DIR/rootfs/"
fi

# Validate binary presence
test -f "$BUNDLE_DIR/rootfs/bin/sh" && echo "Rootfs ready."

#!/usr/bin/env bash
set -euo pipefail

cd container-bundle

# Validate JSON structure
jq empty config.json

# Ensure root directory points to rootfs
ROOT_PATH=$(jq -r '.root.path' config.json)
if [ "$ROOT_PATH" != "rootfs" ] && [ ! -d "$ROOT_PATH" ]; then
  echo "Error: invalid rootfs path in config.json" >&2
  exit 1
fi

echo "OCI bundle syntax verified successfully."