runc-exec(8)

💖 runc-exec(8) — the "hey bestie, let's pop a new process inside ur container" page 💖

okay so real talk: this is the runc-exec page from the System Manager's Manual, and it's genuinely one of the most useful little commands in the whole runc-verse. no cap. it lets you yeet a brand new process into a container that's already up and running. like sliding into someone's DMs but it's a namespace. 🫶

---

✨ NAME ✨

runc-exec — execute new process inside the container 🦋

---

✨ SYNOPSIS ✨

runc exec [option ...] container-id [--] command [arg ...]

runc exec [option ...] -p process.json container-id

so basically there's two whole moods here: either you hand it a command and args directly (and yeah, that -- is there in case ur command has flags that look like runc flags — use it, bestie, it's your friend 💅), or you hand it a process.json with -p and let the file do the talking. pick ur fighter. 🥊

---

✨ OPTIONS ✨

• --console-socket path — the path to an AF_UNIX socket that's gonna receive a file descriptor pointing at the master end of the console's pseudoterminal. there's a whole doc for this, go look: docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩. 📟
• --cwd path — change to path inside the container before running the command. it's giving "cd first, then slay". 🏃‍♀️
• --env, -e name=value — set an environment variable name to value. can be specified multiple times, so stack 'em up like ur fave skincare routine. 🌸
• --tty, -t — allocate a pseudo-TTY. yes, so it feels like a real terminal. iconic behavior. 💅
• --user, -u uid[:gid] — run the command as a user specified by uid, and optionally a group specified by gid. pick ur identity bestie, main character energy. 👑
• --additional-gids, -g gid — add additional group IDs. can be specified multiple times. the more the merrier, fr fr. 🎀
• --process, -p process.json — instead of typing out every single exec parameter on the command line, just pull them from a process.json, a JSON file holding the process specification as defined by the OCI runtime spec ⟨https://github.com/opencontainers/runtime-spec/blob/master/config.md#process⟩. lowkey the laziest and most powerful option here. 😌
• --detach, -d — detach from the container's process. like leaving the group chat on read, but for processes. 🙈
• --pid-file path — specify the file to write the container process' PID to. 📝
• --process-label label — set the asm process label for the process, which is commonly used with selinux(7). 🔐
• --apparmor profile — set the apparmor(7) profile for the process. 🛡️
• --no-new-privs — set the "no new privileges" value for the process. 🚫
• --cap cap — add a capability to the bounding set for the process. can be specified multiple times. collect them like stickers. ⭐
• --preserve-fds N — pass N additional file descriptors into the container (so that's stdio + $LISTEN_FDS + N in total). default is 0. 🧚
• --ignore-paused — allow exec in a paused container. by default, if a container is paused, runc exec errors out — this option overrides that. heads up though: a paused container needs to be resumed for the exec to actually complete. so like, this is not a magic unlock, it's a permission slip. 🫠
• --cgroup path | controller[,controller...]:path — execute a process in a sub-cgroup. if the cgroup you specified doesn't exist, you get an error back, no vibes, no mercy. default is an empty path, which means use the container's top level cgroup.
  • for cgroup v1 only, you can specify a particular controller (or multiple comma-separated controllers), and you can use the option multiple times to set different paths for different controllers.
  • note for cgroup v2: in case the process can't join the top level cgroup, the runc exec fallback is to try joining the cgroup of the container's init. this fallback can be disabled by using --cgroup /. 💀

---

✨ EXIT STATUS ✨

exits with a status of command (unless -d is used, in which case nah), or 255 if an error occurred. so 255 is the "something went wrong bestie" number. 😭

---

✨ EXAMPLES ✨

if the container can run the ps(1) command, the following will output a list of processes running in the container:

# runc exec <container-id> ps

look at that. one line. whole process list. ate. 🔥

---

✨ SEE ALSO ✨

runc(8). that's the whole family, go say hi. 🌈

---

mwah 💜 this has been runc-exec(8) from the System Manager's Manual — same page name on both ends, cute lil bookends, periodt. now go exec something iconic bestie ✨🎀