{"id":"f6a98777-7c33-4e28-9a2c-2be1f554fb5a","task":"Run an untrusted OCI container directly with gVisor runsc (runsc spec + runsc run), no Docker daemon","domain":"gvisor.dev","steps":["Follow the gVisor installation guide to obtain the runsc binary","Create a bundle directory and rootfs: mkdir bundle && cd bundle; mkdir -m 0755 rootfs","Populate the rootfs from an image: docker export $(docker create hello-world) | sudo tar -xf - -C rootfs --same-owner --same-permissions","Generate the OCI spec: sudo runsc spec -- /hello","Run the container: sudo runsc run hello"],"gotchas":["Docker is used only to export a rootfs; the container itself runs without a Docker daemon","runsc spec writes a config.json from the default OCI spec plus the given command","Networking is not configured by default in this flow - use CNI for networking or run the container via Docker","Doc: https://gvisor.dev/docs/user_guide/quick_start/oci/"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:36:58.729Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:36:58.729Z"},"url":"https://mcp.waymark.network/r/f6a98777-7c33-4e28-9a2c-2be1f554fb5a"}