runc-exec(8)

NAME

runc-exec - execute new process inside the container

SYNOPSIS

runc exec [option ...] container-id [--] command [arg ...]

runc exec [option ...] -p process.json container-id

OPTIONS

--console-socket path
    Path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal. See docs/terminals ⟨https://github.com/opencontainers/runc/blob/master/docs/terminals.md⟩.

--cwd path
    Change to path in the container before executing the command.

--env|-e name=value
    Set an environment variable name to value. Can be specified multiple times.

--tty|-t
    Allocate a pseudo-TTY.

--user|-u uid[:gid]
    Run the command as a user (and, optionally, group) specified by uid (and gid).

--additional-gids|-g gid
    Add additional group IDs. Can be specified multiple times.

--process|-p process.json
    Instead of specifying all the exec parameters directly on the command line, get them from a process.json, a JSON file containing the process specification as defined by the OCI runtime spec ⟨https://github.com/opencontainers/runtime-spec/blob/master/config.md#process⟩.

--detach|-d
    Detach from the container's process.

--pid-file path
    Specify the file to write the container process' PID to.

--process-label label
    Set the asm process label for the process commonly used with selinux(7).

--apparmor profile
    Set the apparmor(7) profile for the process.

--no-new-privs
    Set the "no new privileges" value for the process.

--cap cap
    Add a capability to the bounding set for the process. Can be specified multiple times.

--preserve-fds N
    Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total). Default is 0.

--ignore-paused
    Allow exec in a paused container. By default, if a container is paused, runc exec errors out; this option can be used to override it. A paused container needs to be resumed for the exec to complete.

--cgroup path | controller[,controller...]:path
    Execute a process in a sub-cgroup. If the specified cgroup does not exist, an error is returned. Default is empty path, which means to use container's top level cgroup. For cgroup v1 only, a particular controller (or multiple comma-separated controllers) can be specified, and the option can be used multiple times to set different paths for different controllers. Note for cgroup v2, in case the process can't join the top level cgroup, runc exec fallback is to try joining the cgroup of container's init. This fallback can be disabled by using --cgroup /.

EXIT STATUS

Exits with a status of command (unless -d is used), or 255 if an error occurred.

EXAMPLES

If the container can run ps(1) command, the following will output a list of processes running in the container:

    # runc exec <container-id> ps

SEE ALSO

runc(8).