config.md
1
# Container Configuration file
3
The container's top-level directory MUST contain a configuration file called `config.json`.
4
The canonical schema is defined in this document, but there is a JSON Schema in [`schema/config-schema.json`](schema/config-schema.json) and Go bindings in [`specs-go/config.go`](specs-go/config.go).
6
The configuration file contains metadata necessary to implement standard operations against the container.
7
This includes the process to run, environment variables to inject, sandboxing features to use, etc.
8
9
Below is a detailed description of each field defined in the configuration format.
10
11
## Specification version
13
* **`ociVersion`** (string, REQUIRED) MUST be in [SemVer v2.0.0](http://semver.org/spec/v2.0.0.html) format and specifies the version of the Open Container Runtime Specification with which the bundle complies.
14
The Open Container Runtime Specification follows semantic versioning and retains forward and backward compatibility within major versions.
15
For example, if a configuration is compliant with version 1.1 of this specification, it is compatible with all runtimes that support any 1.1 or later release of this specification, but is not compatible with a runtime that supports 1.0 and not 1.1.
17
### Example
20
"ociVersion": "0.1.0"
21
```
22
23
## Root Configuration
25
**`root`** (object, REQUIRED) configures the container's root filesystem.
27
* **`path`** (string, REQUIRED) Specifies the path to the root filesystem for the container.
28
The path can be an absolute path (starting with /) or a relative path (not starting with /), which is relative to the bundle.
29
For example (Linux), with a bundle at `/to/bundle` and a root filesystem at `/to/bundle/rootfs`, the `path` value can be either `/to/bundle/rootfs` or `rootfs`.
30
A directory MUST exist at the path declared by the field.
31
* **`readonly`** (bool, OPTIONAL) If true then the root filesystem MUST be read-only inside the container, defaults to false.
33
### Example
36
"root": {
37
"path": "rootfs",
38
"readonly": true
39
}
40
```
41
42
## Mounts
44
**`mounts`** (array, OPTIONAL) configures additional mounts (on top of [`root`](#root-configuration)).
45
The runtime MUST mount entries in the listed order.
46
The parameters are similar to the ones in [the Linux mount system call](http://man7.org/linux/man-pages/man2/mount.2.html).
47
For Solaris, the mounts corresponds to fs resource in zonecfg(8).
49
* **`destination`** (string, REQUIRED) Destination of mount point: path inside container.
50
This value MUST be an absolute path.
51
For the Windows operating system, one mount destination MUST NOT be nested within another mount (e.g., c:\\foo and c:\\foo\\bar).
52
For the Solaris operating system, this corresponds to "dir" of the fs resource in zonecfg(8).
53
* **`type`** (string, REQUIRED) The filesystem type of the filesystem to be mounted.
54
Linux: *filesystemtype* argument supported by the kernel are listed in */proc/filesystems* (e.g., "minix", "ext2", "ext3", "jfs", "xfs", "reiserfs", "msdos", "proc", "nfs", "iso9660").
55
Windows: ntfs.
56
Solaris: corresponds to "type" of the fs resource in zonecfg(8).
57
* **`source`** (string, REQUIRED) A device name, but can also be a directory name or a dummy.
58
Windows: the volume name that is the target of the mount point, \\?\Volume\{GUID}\ (on Windows source is called target).
59
Solaris: corresponds to "special" of the fs resource in zonecfg(8).
60
* **`options`** (list of strings, OPTIONAL) Mount options of the filesystem to be used.
61
Linux: [supported][mount.8-filesystem-independent] [options][mount.8-filesystem-specific] are listed in [mount(8)][mount.8].
62
Solaris: corresponds to "options" of the fs resource in zonecfg(8).
64
### Example (Linux)
65
66
```json
67
"mounts": [
68
{
69
"destination": "/tmp",
70
"type": "tmpfs",
71
"source": "tmpfs",
72
"options": ["nosuid","strictatime","mode=755","size=65536k"]
75
"destination": "/data",
76
"type": "bind",
77
"source": "/volumes/testing",
78
"options": ["rbind","rw"]
79
}
80
]
81
```
82
83
### Example (Windows)
84
85
```json
86
"mounts": [
87
"myfancymountpoint": {
88
"destination": "C:\\Users\\crosbymichael\\My Fancy Mount Point\\",
89
"type": "ntfs",
90
"source": "\\\\?\\Volume\\{2eca078d-5cbc-43d3-aff8-7e8511f60d0e}\\",
91
"options": []
92
}
93
]
94
```
95
96
See links for details about [mountvol](http://ss64.com/nt/mountvol.html) and [SetVolumeMountPoint](https://msdn.microsoft.com/en-us/library/windows/desktop/aa365561(v=vs.85).aspx) in Windows.
97
98
### Example (Solaris)
99
100
```json
101
"mounts": [
102
{
103
"destination": "/opt/local",
104
"type": "lofs",
105
"source": "/usr/local",
106
"options": ["ro","nodevices"]
107
},
108
{
109
"destination": "/opt/sfw",
110
"type": "lofs",
111
"source": "/opt/sfw"
112
}
113
]
114
```
115
119
**`process`** (object, REQUIRED) configures the container process.
121
* **`terminal`** (bool, OPTIONAL) specifies whether a terminal is attached to that process, defaults to false.
122
On Linux, a pseudoterminal pair is allocated for the container process and the pseudoterminal slave is duplicated on the container process's [standard streams][stdin.3].
123
* **`consoleSize`** (object, OPTIONAL) specifies the console size of the terminal if attached, containing the following properties:
124
* **`height`** (uint, REQUIRED)
125
* **`width`** (uint, REQUIRED)
126
* **`cwd`** (string, REQUIRED) is the working directory that will be set for the executable.
127
This value MUST be an absolute path.
128
* **`env`** (array of strings, OPTIONAL) with the same semantics as [IEEE Std 1003.1-2001's `environ`][ieee-1003.1-2001-xbd-c8.1].
129
* **`args`** (array of strings, REQUIRED) with similar semantics to [IEEE Std 1003.1-2001 `execvp`'s *argv*][ieee-1003.1-2001-xsh-exec].
130
This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*.
132
For Linux-based systems the process structure supports the following process specific fields:
134
* **`capabilities`** (array of strings, OPTIONAL) capabilities is an array that specifies Linux capabilities that can be provided to the process inside the container.
135
Valid values are the strings for capabilities defined in [the man page](http://man7.org/linux/man-pages/man7/capabilities.7.html).
136
* **`rlimits`** (array of objects, OPTIONAL) allows setting resource limits for a process inside the container.
137
Each entry has the following structure:
138
139
* **`type`** (string, REQUIRED) - the 'type' field are the resources defined in [the man page](http://man7.org/linux/man-pages/man2/setrlimit.2.html).
140
* **`soft`** (uint64, REQUIRED) - the value that the kernel enforces for the corresponding resource.
141
* **`hard`** (uint64, REQUIRED) - the ceiling for the soft limit that could be set by an unprivileged process.
142
Only privileged process (under Linux: one with the CAP_SYS_RESOURCE capability) can raise a hard limit.
143
144
If `rlimits` contains duplicated entries with same `type`, the runtime MUST error out.
145
146
* **`apparmorProfile`** (string, OPTIONAL) apparmor profile specifies the name of the apparmor profile that will be used for the container.
147
For more information about Apparmor, see [Apparmor documentation](https://wiki.ubuntu.com/AppArmor)
148
* **`selinuxLabel`** (string, OPTIONAL) SELinux process label specifies the label with which the processes in a container are run.
149
For more information about SELinux, see [Selinux documentation](http://selinuxproject.org/page/Main_Page)
150
* **`noNewPrivileges`** (bool, OPTIONAL) setting `noNewPrivileges` to true prevents the processes in the container from gaining additional privileges.
151
[The kernel doc](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) has more information on how this is achieved using a prctl system call.
153
### User
154
155
The user for the process is a platform-specific structure that allows specific control over which user the process runs as.
157
#### Linux and Solaris User
159
For Linux and Solaris based systems the user structure has the following fields:
161
* **`uid`** (int, REQUIRED) specifies the user ID in the [container namespace][container-namespace].
162
* **`gid`** (int, REQUIRED) specifies the group ID in the [container namespace][container-namespace].
163
* **`additionalGids`** (array of ints, OPTIONAL) specifies additional group IDs (in the [container namespace][container-namespace]) to be added to the process.
165
_Note: symbolic name for uid and gid, such as uname and gname respectively, are left to upper levels to derive (i.e. `/etc/passwd` parsing, NSS, etc)_
166
167
### Example (Linux)
170
"process": {
171
"terminal": true,
172
"consoleSize": {
173
"height": 25,
174
"width": 80
175
},
176
"user": {
177
"uid": 1,
178
"gid": 1,
179
"additionalGids": [5, 6]
181
"env": [
182
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
183
"TERM=xterm"
184
],
185
"cwd": "/root",
186
"args": [
187
"sh"
189
"apparmorProfile": "acme_secure_profile",
190
"selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
191
"noNewPrivileges": true,
192
"capabilities": [
193
"CAP_AUDIT_WRITE",
194
"CAP_KILL",
195
"CAP_NET_BIND_SERVICE"
196
],
197
"rlimits": [
198
{
199
"type": "RLIMIT_NOFILE",
200
"hard": 1024,
201
"soft": 1024
202
}
205
```
206
### Example (Solaris)
207
208
```json
209
"process": {
210
"terminal": true,
211
"consoleSize": {
212
"height": 25,
213
"width": 80
214
},
215
"user": {
216
"uid": 1,
217
"gid": 1,
218
"additionalGids": [2, 8]
219
},
220
"env": [
221
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
222
"TERM=xterm"
223
],
224
"cwd": "/root",
225
"args": [
226
"/usr/bin/bash"
227
]
228
}
229
```
230
231
#### Windows User
232
233
For Windows based systems the user structure has the following fields:
234
235
* **`username`** (string, OPTIONAL) specifies the user name for the process.
236
237
### Example (Windows)
238
239
```json
240
"process": {
241
"terminal": true,
242
"user": {
243
"username": "containeradministrator"
244
},
245
"env": [
246
"VARIABLE=1"
248
"cwd": "c:\\foo",
249
"args": [
250
"someapp.exe",
251
]
252
}
253
```
254
255
256
## Hostname
258
* **`hostname`** (string, OPTIONAL) configures the container's hostname as seen by processes running inside the container.
259
On Linux, this will change the hostname in the [container][container-namespace] [UTS namespace][uts-namespace].
260
Depending on your [namespace configuration](config-linux.md#namespaces), the container UTS namespace may be the [runtime UTS namespace][runtime-namespace].
262
### Example
265
"hostname": "mrsdalloway"
266
```
267
270
**`platform`** specifies the configuration's target platform.
271
272
* **`os`** (string, REQUIRED) specifies the operating system family this image targets.
273
The runtime MUST generate an error if it does not support the configured **`os`**.
274
Bundles SHOULD use, and runtimes SHOULD understand, **`os`** entries listed in the Go Language document for [`$GOOS`][go-environment].
275
If an operating system is not included in the `$GOOS` documentation, it SHOULD be submitted to this specification for standardization.
276
* **`arch`** (string, REQUIRED) specifies the instruction set for which the binaries in the image have been compiled.
277
The runtime MUST generate an error if it does not support the configured **`arch`**.
278
Values for **`arch`** SHOULD use, and runtimes SHOULD understand, **`arch`** entries listed in the Go Language document for [`$GOARCH`][go-environment].
279
If an architecture is not included in the `$GOARCH` documentation, it SHOULD be submitted to this specification for standardization.
281
### Example
282
284
"platform": {
285
"os": "linux",
286
"arch": "amd64"
287
}
288
```
289
290
## Platform-specific configuration
291
292
[**`platform.os`**](#platform) is used to lookup further platform-specific configuration.
293
294
* **`linux`** (object, OPTIONAL) [Linux-specific configuration](config-linux.md).
295
This SHOULD only be set if **`platform.os`** is `linux`.
296
* **`solaris`** (object, OPTIONAL) [Solaris-specific configuration](config-solaris.md).
297
This SHOULD only be set if **`platform.os`** is `solaris`.
298
* **`windows`** (object, OPTIONAL) [Windows-specific configuration](config-windows.md).
299
This SHOULD only be set if **`platform.os`** is `windows`.
300
301
### Example (Linux)
302
303
```json
304
{
305
"platform": {
306
"os": "linux",
307
"arch": "amd64"
308
},
309
"linux": {
310
"namespaces": [
311
{
312
"type": "pid"
313
}
314
]
315
}
316
}
317
```
319
## Hooks
320
321
Lifecycle hooks allow custom events for different points in a container's runtime.
322
323
* **`hooks`** (object, OPTIONAL) MAY contain any of the following properties:
324
* **`prestart`** (array, OPTIONAL) is an array of [pre-start hooks](#prestart).
325
Entries in the array contain the following properties:
326
* **`path`** (string, REQUIRED) with similar semantics to [IEEE Std 1003.1-2001 `execv`'s *path*][ieee-1003.1-2001-xsh-exec].
327
This specification extends the IEEE standard in that **`path`** MUST be absolute.
328
* **`args`** (array of strings, REQUIRED) with the same semantics as [IEEE Std 1003.1-2001 `execv`'s *argv*][ieee-1003.1-2001-xsh-exec].
329
* **`env`** (array of strings, OPTIONAL) with the same semantics as [IEEE Std 1003.1-2001's `environ`][ieee-1003.1-2001-xbd-c8.1].
330
* **`timeout`** (int, OPTIONAL) is the number of seconds before aborting the hook.
331
* **`poststart`** (array, OPTIONAL) is an array of [post-start hooks](#poststart).
332
Entries in the array have the same schema as pre-start entries.
333
* **`poststop`** (array, OPTIONAL) is an array of [post-stop hooks](#poststop).
334
Entries in the array have the same schema as pre-start entries.
336
Hooks allow one to run programs before/after various lifecycle events of the container.
337
Hooks MUST be called in the listed order.
338
The [state](runtime.md#state) of the container is passed to the hooks over stdin, so the hooks could get the information they need to do their work.
339
340
### Prestart
341
342
The pre-start hooks are called after the container process is spawned, but before the user supplied command is executed.
343
They are called after the container namespaces are created on Linux, so they provide an opportunity to customize the container.
344
In Linux, for e.g., the network namespace could be configured in this hook.
345
346
If a hook returns a non-zero exit code, then an error including the exit code and the stderr is returned to the caller and the container is torn down.
347
348
### Poststart
349
350
The post-start hooks are called after the user process is started.
351
For example this hook can notify user that real process is spawned.
352
353
If a hook returns a non-zero exit code, then an error is logged and the remaining hooks are executed.
354
355
### Poststop
356
357
The post-stop hooks are called after the container process is stopped.
358
Cleanup or debugging could be performed in such a hook.
359
If a hook returns a non-zero exit code, then an error is logged and the remaining hooks are executed.
360
361
### Example
362
363
```json
364
"hooks": {
365
"prestart": [
366
{
367
"path": "/usr/bin/fix-mounts",
368
"args": ["fix-mounts", "arg1", "arg2"],
369
"env": [ "key1=value1"]
370
},
371
{
372
"path": "/usr/bin/setup-network"
373
}
374
],
375
"poststart": [
376
{
377
"path": "/usr/bin/notify-start",
378
"timeout": 5
379
}
380
],
381
"poststop": [
382
{
383
"path": "/usr/sbin/cleanup.sh",
384
"args": ["cleanup.sh", "-f"]
385
}
386
]
387
}
388
```
389
390
## Annotations
391
392
**`annotations`** (object, OPTIONAL) contains arbitrary metadata for the container.
393
This information MAY be structured or unstructured.
394
Annotations MUST be a key-value map.
395
If there are no annotations then this property MAY either be absent or an empty map.
396
397
Keys MUST be strings.
398
Keys MUST be unique within this map.
399
Keys MUST NOT be an empty string.
400
Keys SHOULD be named using a reverse domain notation - e.g. `com.example.myKey`.
401
Keys using the `org.opencontainers` namespace are reserved and MUST NOT be used by subsequent specifications.
402
Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key.
404
Values MUST be strings.
405
Values MAY be an empty string.
406
407
```json
408
"annotations": {
409
"com.example.gpu-cores": "2"
410
}
411
```
412
413
## Extensibility
414
Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown property.
415
Instead they MUST ignore unknown properties.
416
417
## Configuration Schema Example
418
419
Here is a full example `config.json` for reference.
420
421
```json
422
{
423
"ociVersion": "0.5.0-dev",
424
"platform": {
425
"os": "linux",
426
"arch": "amd64"
427
},
428
"process": {
429
"terminal": true,
430
"user": {
431
"uid": 1,
432
"gid": 1,
433
"additionalGids": [
434
5,
435
6
436
]
437
},
438
"args": [
439
"sh"
440
],
441
"env": [
442
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
443
"TERM=xterm"
444
],
445
"cwd": "/",
446
"capabilities": [
447
"CAP_AUDIT_WRITE",
448
"CAP_KILL",
449
"CAP_NET_BIND_SERVICE"
450
],
451
"rlimits": [
452
{
453
"type": "RLIMIT_CORE",
454
"hard": 1024,
455
"soft": 1024
456
},
457
{
458
"type": "RLIMIT_NOFILE",
459
"hard": 1024,
460
"soft": 1024
461
}
462
],
463
"apparmorProfile": "acme_secure_profile",
464
"selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
465
"noNewPrivileges": true
466
},
467
"root": {
468
"path": "rootfs",
469
"readonly": true
470
},
471
"hostname": "slartibartfast",
472
"mounts": [
473
{
474
"destination": "/proc",
475
"type": "proc",
476
"source": "proc"
477
},
478
{
479
"destination": "/dev",
480
"type": "tmpfs",
481
"source": "tmpfs",
482
"options": [
483
"nosuid",
484
"strictatime",
485
"mode=755",
486
"size=65536k"
487
]
488
},
489
{
490
"destination": "/dev/pts",
491
"type": "devpts",
492
"source": "devpts",
493
"options": [
494
"nosuid",
495
"noexec",
496
"newinstance",
497
"ptmxmode=0666",
498
"mode=0620",
499
"gid=5"
500
]
501
},
502
{
503
"destination": "/dev/shm",
504
"type": "tmpfs",
505
"source": "shm",
506
"options": [
507
"nosuid",
508
"noexec",
509
"nodev",
510
"mode=1777",
511
"size=65536k"
512
]
513
},
514
{
515
"destination": "/dev/mqueue",
516
"type": "mqueue",
517
"source": "mqueue",
518
"options": [
519
"nosuid",
520
"noexec",
521
"nodev"
522
]
523
},
524
{
525
"destination": "/sys",
526
"type": "sysfs",
527
"source": "sysfs",
528
"options": [
529
"nosuid",
530
"noexec",
531
"nodev"
532
]
533
},
534
{
535
"destination": "/sys/fs/cgroup",
536
"type": "cgroup",
537
"source": "cgroup",
538
"options": [
539
"nosuid",
540
"noexec",
541
"nodev",
542
"relatime",
543
"ro"
544
]
545
}
546
],
547
"hooks": {
548
"prestart": [
549
{
550
"path": "/usr/bin/fix-mounts",
551
"args": [
552
"fix-mounts",
553
"arg1",
554
"arg2"
556
"env": [
557
"key1=value1"
558
]
559
},
560
{
561
"path": "/usr/bin/setup-network"
562
}
563
],
564
"poststart": [
565
{
566
"path": "/usr/bin/notify-start",
567
"timeout": 5
568
}
569
],
570
"poststop": [
571
{
572
"path": "/usr/sbin/cleanup.sh",
573
"args": [
574
"cleanup.sh",
575
"-f"
576
]
577
}
578
]
579
},
580
"linux": {
581
"devices": [
582
{
583
"path": "/dev/fuse",
584
"type": "c",
585
"major": 10,
586
"minor": 229,
587
"fileMode": 438,
588
"uid": 0,
589
"gid": 0
590
},
591
{
592
"path": "/dev/sda",
593
"type": "b",
594
"major": 8,
595
"minor": 0,
596
"fileMode": 432,
597
"uid": 0,
598
"gid": 0
599
}
600
],
601
"uidMappings": [
602
{
603
"hostID": 1000,
604
"containerID": 0,
605
"size": 32000
606
}
607
],
608
"gidMappings": [
609
{
610
"hostID": 1000,
611
"containerID": 0,
612
"size": 32000
613
}
614
],
615
"sysctl": {
616
"net.ipv4.ip_forward": "1",
617
"net.core.somaxconn": "256"
618
},
619
"cgroupsPath": "/myRuntime/myContainer",
620
"resources": {
621
"network": {
622
"classID": 1048577,
623
"priorities": [
624
{
625
"name": "eth0",
626
"priority": 500
627
},
628
{
629
"name": "eth1",
630
"priority": 1000
631
}
632
]
633
},
634
"pids": {
635
"limit": 32771
636
},
637
"hugepageLimits": [
638
{
639
"pageSize": "2MB",
640
"limit": 9223372036854772000
641
}
642
],
643
"oomScoreAdj": 100,
644
"memory": {
645
"limit": 536870912,
646
"reservation": 536870912,
647
"swap": 536870912,
648
"kernel": 0,
649
"kernelTCP": 0,
650
"swappiness": 0
651
},
652
"cpu": {
653
"shares": 1024,
654
"quota": 1000000,
655
"period": 500000,
656
"realtimeRuntime": 950000,
657
"realtimePeriod": 1000000,
658
"cpus": "2-3",
659
"mems": "0-7"
660
},
661
"disableOOMKiller": false,
662
"devices": [
663
{
664
"allow": false,
665
"access": "rwm"
666
},
667
{
668
"allow": true,
669
"type": "c",
670
"major": 10,
671
"minor": 229,
672
"access": "rw"
673
},
674
{
675
"allow": true,
676
"type": "b",
677
"major": 8,
678
"minor": 0,
679
"access": "r"
680
}
681
],
682
"blockIO": {
683
"blkioWeight": 10,
684
"blkioLeafWeight": 10,
685
"blkioWeightDevice": [
686
{
687
"major": 8,
688
"minor": 0,
689
"weight": 500,
690
"leafWeight": 300
691
},
692
{
693
"major": 8,
694
"minor": 16,
695
"weight": 500
696
}
697
],
698
"blkioThrottleReadBpsDevice": [
699
{
700
"major": 8,
701
"minor": 0,
702
"rate": 600
703
}
704
],
705
"blkioThrottleWriteIOPSDevice": [
706
{
707
"major": 8,
708
"minor": 16,
709
"rate": 300
710
}
711
]
712
}
713
},
714
"rootfsPropagation": "slave",
715
"seccomp": {
716
"defaultAction": "SCMP_ACT_ALLOW",
717
"architectures": [
718
"SCMP_ARCH_X86"
719
],
720
"syscalls": [
721
{
722
"name": "getcwd",
723
"action": "SCMP_ACT_ERRNO"
724
}
725
]
726
},
727
"namespaces": [
728
{
729
"type": "pid"
730
},
731
{
732
"type": "network"
733
},
734
{
735
"type": "ipc"
736
},
737
{
738
"type": "uts"
739
},
740
{
741
"type": "mount"
742
},
743
{
744
"type": "user"
745
},
746
{
747
"type": "cgroup"
749
],
750
"maskedPaths": [
751
"/proc/kcore",
752
"/proc/latency_stats",
753
"/proc/timer_stats",
754
"/proc/sched_debug"
755
],
756
"readonlyPaths": [
757
"/proc/asound",
758
"/proc/bus",
759
"/proc/fs",
760
"/proc/irq",
761
"/proc/sys",
762
"/proc/sysrq-trigger"
763
],
764
"mountLabel": "system_u:object_r:svirt_sandbox_file_t:s0:c715,c811"
765
},
766
"annotations": {
767
"com.example.key1": "value1",
768
"com.example.key2": "value2"
770
}
771
```
772
773
[container-namespace]: glossary.md#container-namespace
774
[go-environment]: https://golang.org/doc/install/source#environment
775
[ieee-1003.1-2001-xbd-c8.1]: http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html#tag_08_01
776
[ieee-1003.1-2001-xsh-exec]: http://pubs.opengroup.org/onlinepubs/009695399/functions/exec.html
777
[runtime-namespace]: glossary.md#runtime-namespace
778
[uts-namespace]: http://man7.org/linux/man-pages/man7/namespaces.7.html
779
[mount.8-filesystem-independent]: http://man7.org/linux/man-pages/man8/mount.8.html#FILESYSTEM-INDEPENDENT_MOUNT%20OPTIONS
780
[mount.8-filesystem-specific]: http://man7.org/linux/man-pages/man8/mount.8.html#FILESYSTEM-SPECIFIC_MOUNT%20OPTIONS
781
[mount.8]: http://man7.org/linux/man-pages/man8/mount.8.html
782
[stdin.3]: http://man7.org/linux/man-pages/man3/stdin.3.html