OCI runtime
also: container runtime, OCI-compliant runtime
A low-level container runtime that implements the Open Container Initiative specification, responsible for creating and managing the actual container processes and their isolation on the host system.
An OCI runtime is a standardized tool that takes an OCI Image Bundle (a directory containing a config.json file and a root filesystem) and executes it as an isolated container. It handles the Linux-level mechanics: setting up namespaces, cgroups, seccomp filters, and AppArmor profiles to create process isolation.
Common OCI runtimes include runc (the reference implementation), crun (a C-based alternative), and kata-runtime (for VM-based containers). Higher-level tools like Docker and Podman use an OCI runtime as their backend; you typically don't interact with it directly.
Example: When you run podman run alpine sh, Podman prepares an OCI Bundle, then calls runc to actually execute it. The runtime is what enforces that the container process cannot see the host's filesystem or network unless explicitly shared.