Project
runc is a CNCF low-level container runtime implementing the OCI spec, handling namespaces, cgroups, and process execution for tools like Docker and containerd.
containerd 2.1.0, shipped December 2024, added a cgroup_writable handler that gives a Kubernetes pod a writable cgroup subtree without privileged: true. Set hostUsers: false and the pod can create child cgroups but cannot raise its own memory limit.
Reality
Docker released its Sandbox Kit Spec under Apache 2.0 and is taking it to CNCF, with nine named vendors already shipping Kits for their own tools. Enforcement still belongs to the runtime. In the post, that runtime is Docker Sandboxes.
Reality
A walkthrough builds one with unshare, chroot and an Alpine tarball, no daemon involved. The useful part is what it tells you the day Docker is not on the box and root is.
Reality
The standard --tun=userspace-networking advice produces a tailnet member you cannot SSH into. The repair is two lines of container config, not a privileged container.
Reality
A dev.to piece maps validate-then-commit payment flows onto a race condition class catalogued in 2006. The useful part is not the taxonomy but where the check has to live.
Reality