• https://github.com/opencontainers/runc

runc is the reference OCI runtime. It takes a container bundle (rootfs plus config.json) and creates the namespaces, cgroups, and process. containerd, CRI-O, and Docker all call runc under the hood. You rarely use it directly, but it can show what's running when the higher layers are confused.

Each caller keeps its runc state under its own --root, so you have to point runc at the right one.

List containers¶

Kubernetes containers (containerd)¶

sudo runc --root /run/containerd/runc/k8s.io list

Docker containers¶

sudo runc --root /run/docker/runtime-runc/moby list

Inspect one container¶

sudo runc --root /run/containerd/runc/k8s.io state <container-id>
sudo runc --root /run/containerd/runc/k8s.io ps <container-id>

Use crictl or nerdctl (see containerd) for anything beyond read-only inspection. Changing container state through runc directly bypasses containerd's bookkeeping.