myrun is an educational, rootful container runtime. It demonstrates the core Linux primitives behind containers, but it is not a hardened sandbox.

The runtime currently needs root privileges on the host to:

• mount OverlayFS
• create mount and PID namespaces
• call pivot_root
• create and configure veth network interfaces
• create cgroups under /sys/fs/cgroup

The parent process performs privileged setup, then the child drops privileges before executing the requested command.

After namespace, filesystem, cgroup, and optional network setup, the container init process:

• sets no_new_privs
• drops all effective, permitted, and inheritable Linux capabilities
• optionally installs --seccomp-basic, which denies a small set of high-risk syscalls

The runtime also uses:

• PID namespace isolation
• UTS namespace isolation
• mount namespace isolation
• optional network namespace isolation
• cgroups v2 memory, CPU, and process limits
• OverlayFS copy-on-write root filesystems

This project does not currently implement:

• user namespaces
• UID/GID remapping
• a complete Docker-style seccomp profile
• AppArmor or SELinux integration
• read-only rootfs mode
• masked or readonly sensitive paths such as /sys, /proc/sys, or /proc/sysrq-trigger
• capability allowlists before setup

Because there is no user namespace, UID 0 in the container is still created by a rootful host runtime. The final process has no capabilities, but this should still be treated as a learning runtime rather than a security boundary for untrusted workloads.

A user namespace version would:

1. clone with CLONE_NEWUSER
2. pause the child before privileged setup
3. have the parent write /proc/<pid>/uid_map and /proc/<pid>/gid_map
4. write deny to /proc/<pid>/setgroups before gid_map
5. map container root to an unprivileged host UID/GID
6. carefully rework mount, cgroup, and network setup around the reduced host privileges

That is a valuable next upgrade, but it changes the runtime architecture enough that it deserves a separate implementation pass.