runtime-spec

This is really cool - the Open Container bundle format is quite easy to grok; it's a tarball* containing a config.json file for metadata, and a root filesystem. See: https://github.com/opencontainers/runtime-spec/blob/master/b... I'm really digging the end result of the spec - it mostly defines a bunch of conventions on top of easy formats. Kind of wish the marketing around it would be less buzz wordy, because the end result is quite straight forward. * (It's usually a tarball; nothing stopping you from sharing images over torrent for example.)

The specs can be found here: https://github.com/opencontainers/image-spec/blob/master/spe... https://github.com/opencontainers/runtime-spec/blob/master/s...

See the implementation lists for both specs: https://github.com/opencontainers/image-spec/blob/master/imp... https://github.com/opencontainers/runtime-spec/blob/master/i... Now that things are 1.0 we expect many people to start implementing the spec. For example, the transition steps required to add OCI v1.0 support on-top of Docker v2.2 support for an application primarily involves changing a few strings. See the implementation notes here. https://github.com/opencontainers/image-spec/blob/6060c3b6c6...

Its probably a good time to stop using containers to mean LXC considering the new OCI runc specs containers on Solaris using Zones and Windows using Hyper-V: https://github.com/opencontainers/runtime-spec/blob/master/s...

openbsd's pledge seems like an easy-to-use API. on linux the low-level building blocks that can achieve similar are seccomp and namespaces, but the only abstractions that I am aware of involve separate launcher processes like runc[0] or firejail[1]. A library providing similar functionality to pledge that could be added during application startup or when doing fork+exec would be great. [0] https://github.com/opencontainers/runtime-spec/blob/master/c... [1] https://firejail.wordpress.com/features-3/