Currently if you take a random Docker image's config file (then translate it to an OCI one using skopeo) you'll get a config.json which looks like this:

{
  "ociVersion": "1.0.0-rc2",
  "platform": {
    "os": "linux",
    "arch": "amd64"
  },
  "process": {
    "terminal": true,
    "user": {
      "uid": 0,
      "gid": 0
    },
    "args": [
      "sh"
    ],
    "env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    ],
    "cwd": "/"
  },
  "root": {
    "path": "rootfs"
  },
  "hooks": {},
  "linux": {
    "resources": {
      "memory": {
        "limit": 0,
        "reservation": 0,
        "swap": 0
      },
      "cpu": {
        "shares": 0
      }
    }
  }
}

This is wrong. On Linux you have to include the "namespaces": [ { "type": "mount" } ] at the very least in order for it to even be possible for you to start inside a container (otherwise your container is running the host context -- not very useful). Preferably we should also add the PID namespace.

In addition, we have to add the default set of mounts mandated by opencontainers/runtime-spec#164. Namely we have to add /proc, /sys and /dev (runC will handle everything else for us).