{
  "product": "Specification (reference)",
  "title": "Container Runtime",
  "summary": "Build, run and isolate application images reproducibly.",
  "category": "devtools",
  "entries": [
    {
      "path": [
        "AI",
        "Images",
        "Build from a declarative file with cached layers"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Images",
        "Layers are content-addressed and shared between images"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Images",
        "Multi-stage builds so build tools stay out of the result"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Images",
        "Multi-architecture images"
      ],
      "value": "amd64, arm64",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Registry",
        "Push, pull and tag against a registry with auth"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Registry",
        "Image digests pin exactly, tags do not"
      ],
      "value": "",
      "status": "yes",
      "note": "the reproducibility distinction"
    },
    {
      "path": [
        "AI",
        "Runtime",
        "Namespaced processes, filesystem and network"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Runtime",
        "CPU and memory limits enforced"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Runtime",
        "Read-only root filesystem and dropped capabilities available"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Runtime",
        "Run as a non-root user"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Storage",
        "Volumes and bind mounts with explicit lifetimes"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Networking",
        "Port publishing and container-to-container networks"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Lifecycle",
        "Start, stop, restart policy, health check"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Lifecycle",
        "Signals forwarded to PID 1 for graceful shutdown"
      ],
      "value": "",
      "status": "yes",
      "note": "the zombie-process trap"
    },
    {
      "path": [
        "AI",
        "Observability",
        "Logs, stats and exec into a running container"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Supply chain",
        "Image scanning and signature verification"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    }
  ]
}