Limited support for traditional containers

Oct 13, 2025 by miodeya.com 7 views

[Sandbox] urunc: A CRI- Compatible Runtime for Unikernels and Application Kernels

Introduction

In the realm of cloud-native computing, the need for efficient, secure, and scalable deployments has led to the development of various technologies, including unikernels and application kernels. However, integrating these technologies into cloud-native environments has proven to be a significant challenge. This is where urunc comes in – a CRI-compatible runtime designed to bridge the gap between unikernels and containerized environments, enabling seamless integration with cloud-native architectures.

What are Unikernels?

Unikernels are specialized, lightweight binaries that bundle an application with only its essential dependencies, including libraries and kernel components. They boot in milliseconds, use minimal resources, reduce the exposure of the host to the application, and can leverage VM-level isolation, making them a strong alternative to containers for cloud-native deployments.

The Challenge of Unikernels in Cloud-Native Environments

Nonetheless, unikernels operate in a fundamentally different execution environment compared to traditional processes and containers. They typically run as VMs or on specialized monitors that facilitate external communication. This inherent difference introduces challenges in orchestration, tooling, and integration with existing cloud platforms. As a result, their adoption in cloud-native ecosystems remains limited.

How urunc Addresses the Gap

urunc addresses this gap by enabling seamless unikernel integration within the cloud-native ecosystem. urunc aligns with container semantics and leverages OCI tooling and methodologies, aiming to be the “runc for unikernels”, while maintaining CRI compatibility. Unikernels are packaged in OCI-compatible images and urunc launches them on top of the underlying VM or seccomp monitors. Thus, developers and administrators can package, deliver, deploy, and manage unikernels using familiar cloud-native tools and practices.

Key Features of urunc

urunc acts as any other low-level OCI runtime. The main difference of urunc with other container runtimes is that instead of spawning a process, it uses a VM or a sandbox monitor to run the unikernel. It is important to note that urunc does not require any auxiliary processes running alongside the user's application inside or outside the unikernel. As a result, urunc is able to support any unikernel framework or similar technologies, while maintaining minimal execution overhead.

Benefits of urunc

urunc unlocks new possibilities for lightweight, secure, and high-performance workloads while maintaining interoperability with existing cloud infrastructure. By providing a seamless path to cloud integration, urunc enables unikernel projects to fully participate in the cloud-native ecosystem. Moreover, urunc's extensible architecture allows support for a wide range of monitors and guest execution environments, making it a highly flexible solution.

Cloud Native 'Fit'

As a low-level container runtime, urunc operates at the core of cloud computing, bridging the gap between unikernels and cloud-native environments. It combines the efficiency, security, and minimalism of unikernels with the standardization and automation that define modern cloud-native technologies. Furthermore, urunc is a CRI-compatible runtime and seamlessly integrates with Kubernetes and other cloud-native orchestration tools, ensuring that unikernels can be managed just like traditional containers.

Cloud Native 'Integration'

urunc integrates smoothly with containerd and offers experimental support for CRI-O and podman . However, for the last two projects, additional work is required to provide robust support. Furthermore, urunc has been successfully used to deploy unikernels over Kubernetes, k3s, but also Knative, Argo-cd and Karmada. Moreover, urunc provides experimental support for wasmedge executing it inside a lightweight and minimal Linux VM.

Cloud Native Overlap

The only CNCF project directly related to urunc is youki, another low-level container runtime. While both projects create a containerized environment for application execution, they take fundamentally different approaches. Youki follows a traditional container runtime model, leveraging OS-level virtualization mechanisms such as namespaces and cgroups to isolate workloads. In contrast, urunc goes a step further, adding an additional layer of isolation by running applications inside a VM or on top of a monitor.

Similar Projects

Traditional container runtimes:

runc : The widely used traditional container runtime written in Go
youki : A container runtime written in Rust
crun : A fast and lightweight fully featured OCI runtime and C library for running containers

The key distinction between urunc and traditional container runtimes is that urunc does not execute applications directly on the host. Instead, it runs them inside a VM or on top of a monitor, introducing an additional layer of isolation between the application and the host.

Sandboxed container runtimes:

Kata-containers : an open source project and community working to build a standard implementation of lightweight VMs that feel and perform like containers, but provide the workload isolation and security advantages of VMs.
gvisor : an OCI runtime (runsc) that spawns applications inside a userspace kernel, providing a software based sandbox for containers.

The key distinction between urunc and Kata-containers lies in their approach to virtualization. Unlike Kata Containers, which run a container inside a VM, urunc runs a VM within a containerized environment. Additionally, urunc eliminates the need for auxiliary processes inside or outside the VM to manage the container. Instead, it interacts directly with the VMM or other execution monitors, streamlining management and reducing overhead. Compared to gVisor, urunc supports both software-based and hardware-backed sandboxing solutions, offering greater flexibility. Moreover, its extensible architecture allows support for a wide range of monitors and guest execution environments.

Conclusion

urunc is a groundbreaking solution that bridges the gap between unikernels and cloud-native environments. By providing a seamless path to cloud integration, urunc enables unikernel projects to fully participate in the cloud-native ecosystem. Its extensible architecture, combined with its ability to support a wide range of monitors and guest execution environments, makes it a highly flexible solution. As a CRI-compatible runtime, urunc seamlessly integrates with Kubernetes and other cloud-native orchestration tools, ensuring that unikernels can be managed just like traditional containers.
[Sandbox] urunc: A CRI- Compatible Runtime for Unikernels and Application Kernels - Q&A

Introduction

In our previous article, we introduced urunc, a CRI-compatible runtime designed to bridge the gap between unikernels and containerized environments, enabling seamless integration with cloud-native architectures. In this article, we will answer some of the most frequently asked questions about urunc, providing a deeper understanding of its features, benefits, and use cases.

Q: What is urunc and how does it differ from traditional container runtimes?

A: urunc is a low-level container runtime that runs unikernels inside a VM or on top of a monitor, introducing an additional layer of isolation between the application and the host. Unlike traditional container runtimes, which execute applications directly on the host, urunc provides a more secure and efficient way to run unikernels in cloud-native environments.

Q: What are the benefits of using urunc?

A: urunc provides several benefits, including:

Improved security: By running unikernels inside a VM or on top of a monitor, urunc provides an additional layer of isolation between the application and the host, reducing the risk of security breaches.
Increased efficiency: urunc's use of VMs or monitors to run unikernels reduces the overhead associated with traditional container runtimes, making it a more efficient solution.
Seamless integration with cloud-native environments: urunc is designed to work seamlessly with cloud-native environments, including Kubernetes and other orchestration tools.

Q: How does urunc integrate with cloud-native environments?

A: urunc integrates with cloud-native environments through its support for CRI (Container Runtime Interface) and OCI (Open Container Initiative) standards. This allows urunc to work seamlessly with cloud-native orchestration tools, such as Kubernetes, and provides a consistent way to manage unikernels and traditional containers.

Q: What are the system requirements for running urunc?

A: urunc requires a Linux-based system with a compatible kernel version. The specific system requirements will depend on the version of urunc being used, but in general, urunc requires:

Linux kernel version 4.15 or later
64-bit architecture
Minimum 2 GB of RAM

Q: How do I get started with urunc?

A: To get started with urunc, follow these steps:

Install urunc: Install urunc on your system using the package manager or by building it from source.
Configure urunc: Configure urunc to work with your cloud-native environment by setting up the necessary configuration files.
Run urunc: Run urunc to start the unikernel runtime and begin managing your unikernels.

Q: What are the limitations of urunc?

A: While urunc provides several benefits, it also has some limitations, including:

Limited support for traditional containers: urunc is designed to run unikernels, and while it can run traditional containers, it may not provide the same level of performance or efficiency.
Requires compatible kernel version: urunc requires a compatible kernel version to run, which may limit its use on certain systems.
May require additional configuration: urunc may require additional configuration to work with certain cloud-native environments or to take advantage of its features.

Conclusion

urunc is a powerful tool for running unikernels in cloud-native environments. By providing a seamless path to cloud integration, urunc enables unikernel projects to fully participate in the cloud-native ecosystem. While it has some limitations, urunc provides several benefits, including improved security, increased efficiency, and seamless integration with cloud-native environments.