Docker has features that make the sandboxing environment abstract. It abstracts the specifics of the underlying host, without needing to rewrite the application and without excessive performance overheads. These features were integrated into a unified low-level component called runC. Later, Docker Inc made runC as a standalone tool. runC is a lightweight, portable container runtime. It has all the plumbing code that is used by Docker to interact with container-related system features. It is designed for security and scalability and is independent of the rest of the Docker platform. It has native support for security features available in Linux – SELinux, Apparmor, seccomp, control groups, capability drop, pivot_root, uid/gid dropping and more. runC has portable performance profiles, contributed by Google engineers. The Open Container Project, under the auspices of the…
