Spec coverage

August 13, 2026 ยท View on GitHub

This document tracks runj's coverage of the OCI runtime specification, version 1.3.0.

  • [x] - implemented
  • [ ] - not yet implemented

runj currently ignores configuration it does not implement rather than returning an error. The specification requires a runtime to error when it cannot apply a configured property; closing that gap is itself an item below.

Lifecycle operations

  • create
  • start
  • kill
  • delete
  • state

Process

  • process.args
  • process.env
  • process.terminal
  • process.user (uid, gid, umask, additionalGids)
  • process.cwd
  • process.rlimits - tagged linux,solaris,zos in the spec, but setrlimit(2) applies on FreeBSD. See oci.md for the supported RLIMIT_* types and how unsupported types are handled.
  • process.consoleSize

Root

  • root.path
  • root.readonly

Other top-level fields

  • hostname
  • mounts
  • annotations (forwarded to hooks)
  • domainname
  • error on unsupported configuration (see note above)
  • honor the bundle's ociVersion

Hooks

  • createRuntime
  • poststop
  • poststart
  • createContainer
  • startContainer
  • prestart (deprecated in the spec)

FreeBSD (freebsd.*)

  • jail.ip4
  • jail.ip4Addr
  • jail.vnet
  • jail.vnetInterfaces (moved with ifconfig(8), not set as a jail param)
  • jail.ip6, jail.ip6Addr
  • jail.allow.* - capability toggles (setHostname, rawSockets, chflags, mount, quotas, socketAf, mlock, reservedPorts, suser)
  • freebsd.devices - individual device nodes (only whole-devfs mounts work today)
  • jail.parent - parent jail / shared vnet
  • jail.host - UTS sharing mode
  • jail.interface - interface for ip4Addr/ip6Addr
  • jail.sysvmsg - SystemV IPC message queue sharing
  • jail.sysvsem - SystemV IPC semaphore sharing
  • jail.sysvshm - SystemV IPC shared memory sharing
  • jail.enforceStatfs - mount visibility

Resource limits

  • kernel rctl(8) limits (the FreeBSD analogue to Linux linux.resources)