{"id":13509577,"url":"https://github.com/gotoz/runq","last_synced_at":"2025-03-30T13:32:32.228Z","repository":{"id":45545943,"uuid":"123118062","full_name":"gotoz/runq","owner":"gotoz","description":"run regular Docker images in KVM/Qemu","archived":false,"fork":false,"pushed_at":"2024-05-19T08:21:51.000Z","size":5382,"stargazers_count":797,"open_issues_count":6,"forks_count":46,"subscribers_count":29,"default_branch":"master","last_synced_at":"2024-08-02T02:14:11.806Z","etag":null,"topics":["docker","kvm","oci","qemu","runtime"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gotoz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-27T11:13:31.000Z","updated_at":"2024-07-16T23:06:21.000Z","dependencies_parsed_at":"2024-04-19T15:37:59.774Z","dependency_job_id":"00c07617-4f74-4394-8ce0-58837862def8","html_url":"https://github.com/gotoz/runq","commit_stats":{"total_commits":191,"total_committers":9,"mean_commits":21.22222222222222,"dds":0.05235602094240843,"last_synced_commit":"8d9490a7f431f4619b8cf631296a37ed6484232f"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gotoz%2Frunq","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gotoz%2Frunq/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gotoz%2Frunq/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gotoz%2Frunq/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gotoz","download_url":"https://codeload.github.com/gotoz/runq/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222552915,"owners_count":17002160,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","kvm","oci","qemu","runtime"],"created_at":"2024-08-01T02:01:09.864Z","updated_at":"2024-11-01T09:31:47.185Z","avatar_url":"https://github.com/gotoz.png","language":"Go","funding_links":[],"categories":["Go","docker"],"sub_categories":[],"readme":"# runq\n\nrunq is a hypervisor-based Docker runtime based on [runc](https://github.com/opencontainers/runc)\nto run regular Docker images as a lightweight KVM/Qemu virtual machine.\nThe focus is on solving real problems, not on number of features.\n\nKey differences to other hypervisor-based runtimes:\n\n* minimalistic design, small code base\n* no modification to existing Docker tools (dockerd, containerd, runc...)\n* coexistence of runq containers and regular runc containers\n* no extra state outside of Docker (no libvirt, no changes to /var/run/...)\n* small init program, no systemd\n* no custom guest kernel or custom qemu needed\n* runs on x86_64 and s390x (\u003e= z13)\n\n## runc vs. runq\n\n```text\n       runc container                   runq container\n       +-------------------------+      +-------------------------+\n       |                         |      |                     VM  |\n       |                         |      | +---------------------+ |\n       |                         |      | |                     | |\n       |                         |      | |                     | |\n       |                         |      | |                     | |\n       |       application       |      | |     application     | |\n       |                         |      | |                     | |\n       |                         |      | |                     | |\n       |                         |      | +---------------------+ |\n       |                         |      | |     guest kernel    | |\n       |                         |      | +---------------------+ |\n       |                         |      |           qemu          |\n       +-------------------------+      +-------------------------+\n ----------------------------------------------------------------------\n                                host kernel\n```\n\n## Installation\n\nrunq requires a host kernel \u003e= 4.8 with KVM and VHOST_VSOCK support enabled.\nThe easiest way to build runq and to put all dependencies together is using Docker.\nFor fast development cycles a regular build environment might be more\nefficient. For this refer to section [Developing runq](#developing-runq).\n\n```sh\n# get the runq and runc source code\ngit clone --recurse-submodules https://github.com/gotoz/runq.git\n\n# compile and create a release tar file in a Docker container\ncd runq\nmake release\n\n# install runq to `/var/lib/runq`\nmake release-install\n```\n\nRegister runq as Docker runtime with appropriate defaults. See [daemon.json](test/testdata/daemon.json) for more options.\n\n```json\n/etc/docker/daemon.json\n{\n  \"runtimes\": {\n    \"runq\": {\n      \"path\": \"/var/lib/runq/runq\",\n      \"runtimeArgs\": [\n        \"--cpu\", \"1\",\n        \"--mem\", \"256\",\n        \"--dns\", \"8.8.8.8,8.8.4.4\",\n        \"--tmpfs\", \"/tmp\"\n      ]\n    }\n  }\n}\n```\n\nreload Docker config\n\n```sh\nsystemctl reload docker.service\n```\n\n### TLS certificates\n\n*runq-exec* creates a secure connection between host and VM guests. Users of *runq-exec* are\nauthenticated via a client certificate. Access to the client certificate must be limited to\nDocker users only.\n\nThe CA and server certificates must be installed in `/var/lib/runq/qemu/certs`.\nAccess must be limited to the root user only.\n\nExamples of server and client TLS certificates can be created with the script:\n\n```sh\n/var/lib/runq/qemu/mkcerts.sh\n```\n\nNote: On x86 and s390x \u003c z14 the host must provide sufficient entropy to the VM guests via virtio-rng.\nIf there is not enough entropy available on the host booting of guests can fail with a timeout error.\nThe entropy that's currently available can be checked with:\n\n```sh\ncat /proc/sys/kernel/random/entropy_avail\n```\n\nThe number returned should always be greater than 1000. On s390x \u003e=z14 random data is provided\nby the hardware driven trng device (kernel module s390-trng).\n\n#### Kernel module vhost_vsock\n\nThe kernel module `vhost_vsock` must be loaded on the host. This can be achieved by creating\na config file for the systemd-modules-load service: `/etc/modules-load.d/vhost-vsock.conf`:\n\n```sh\n# Load vhost_vsock for runq\nvhost_vsock\n```\n\n## Usage examples\n\nthe simplest example\n\n```sh\ndocker run --runtime runq -ti busybox sh\n```\n\ncustom VM with 512MiB memory and 2 CPUs\n\n```sh\ndocker run --runtime runq -e RUNQ_MEM=512 -e RUNQ_CPU=2 -ti busybox sh\n```\n\nallow loading of extra kernel modules by adding the SYS_MODULE capability\n\n```sh\ndocker run --runtime runq --cap-add sys_module -ti busybox sh -c \"modprobe brd \u0026\u0026 lsmod\"\n\n```\n\nfull example PostgreSQL with custom storage\n\n```sh\ndd if=/dev/zero of=data.img bs=1M count=200\nmkfs.ext4 -F data.img\n\ndocker run \\\n    --runtime runq \\\n    --name pgserver \\\n    -e RUNQ_CPU=2 \\\n    -e RUNQ_MEM=512 \\\n    -e POSTGRES_PASSWORD=mysecret \\\n    -v $PWD/data.img:/dev/runq/0001/none/ext4/var/lib/postgresql \\\n    -d postgres:alpine\n\nsleep 10\n\ndocker run \\\n    --runtime runq \\\n    --link pgserver:postgres \\\n    --rm \\\n    -e PGPASSWORD=mysecret \\\n    postgres:alpine psql -h postgres -U postgres -c \"select 42 as answer;\"\n\n#  answer\n# --------\n#      42\n# (1 row)\n\n```\n\n### Container with Systemd\n\nContainers running Systemd should have the environment variable `RUNQ_SYSTEMD` set to `1`.\nWith `RUNQ_SYSTEMD=1` the behaviour changes as follows:\n\n* The entry-point return code (Systemd exit code) must be treated differently to ensure that\n  `poweroff` and `reboot` executed inside the container work as expected especially to\n   support Docker containers created with '--restart on-failure:1'. Therefore\n  * on **poweroff** and **halt** the Systemd exit code is 2 but the return code as seen by Docker is 0.\n  * In all other cases the return code as seen by Docker is 1.\n\n* When stopping or restarting a container the signal sent to the docker-entry point is\n  SIGTERM. Systemd usually ignores SIGTERM. In order to trigger a clean Systemd\n  shutdown the signal is therefore modified from SIGTERM to SIGRTMIN+4. When Systemd receives SIGRTMIN+4\n  it starts the poweroff.target unit.\n\n* With `RUNQ_SYSTEMD=1` Linux cgroups are not mounted because this will be done later by Systemd.\n\nSee [test/examples/Dockerfile.systemd](test/examples/Dockerfile.systemd)\nand [test/examples/systemd.sh](test/examples/systemd.sh) for an example.\n\n### /.runqenv\n\nRunq can write the container environment variables in a file named `/.runqenv` placed in\nthe root directory of the container. This might be useful for containers running Systemd\nas entry point. This feature can be enabled globally by configuring `--runqenv` in\n[/etc/docker/daemon.json](test/testdata/daemon.json) or for a single container by setting\nthe environment variable `RUNQ_RUNQENV` to a true value.\n\n### 9p cache mode\n\nThe default 9p cache mode is 'mmap' but can be configured by setting the global\nruntime parameter `--9pcache` in [/etc/docker/daemon.json](test/testdata/daemon.json)\nor for each container individually by setting the container environment variable RUNQ_9PCACHE.\nValid cache modes are none, loose, fscache and mmap. For details see [9prst.txt](https://www.kernel.org/doc/html/latest/_sources/filesystems/9p.rst.txt).\n\n### Qemu CPU model and flags\n\nThe default Qemu CPU model is 'host' with no flags (KVM processor with all supported host features) but can be\nconfigured by setting the global runtime parameter `--cpuargs` in [/etc/docker/daemon.json](test/testdata/daemon.json)\nor for each container individually by setting the container environment variable RUNQ_CPUARGS.\nE.g. `--env RUNQ_CPUARGS=host,rtm=off`.\nSee `qemu-system-x86_64 -cpu help` for a list of available CPU models and CPUID flags.\n\n## runq Components\n\n```text\n   docker cli\n      dockerd engine\n         docker-containerd-shim\n               runq                                           container\n              +--------------------------------------------------------+\n              |                                                        |\n  docker0     |                                                  VM    |\n    `veth \u003c------\u003e veth                 +--------------------------+   |\n              |        `\u003c--- macvtap ---|-\u003e eth0                   |   |\n              |  proxy  \u003c-----------------\u003e init                   |   |\n runq-exec \u003c-----------tls----------------\u003e `vsockd                |   |\n              |                         |+-------------namespace--+|   |\n overlayfs \u003c-----9pfs-------------------||-\u003e /                    ||   |\n              |                         ||                        ||   |\n block dev \u003c-----virtio-blk-------------||-\u003e /dev/vdx             ||   |\n              |                         ||                        ||   |\n              |                         ||                        ||   |\n              |                         ||                        ||   |\n              |                         ||       application      ||   |\n              |                         ||                        ||   |\n              |                         |+------------------------+|   |\n              |                         |       guest kernel       |   |\n              |                         +--------------------------+   |\n              |                                     qemu               |\n              +--------------------------------------------------------+\n\n --------------------------------------------------------------------------\n                                host kernel\n```\n\n* cmd/runq\n  * new docker runtime\n\n* cmd/proxy\n  * new Docker entry point\n  * first process in container (PID 1)\n  * configures and starts Qemu (network, disks, ...)\n  * forwards signals to VM init\n  * receives application exit code\n\n* cmd/init\n  * first process in VM (PID 1)\n  * initializes the VM guest (network, disks, ...)\n  * starts entry-point in PID and Mount namespace\n  * sends signals to target application\n  * forwards application exit code back to proxy\n\n* cmd/runq-exec\n  * command line utility similar to *docker exec*\n\n* cmd/nsenter\n  * enters the namespaces of entry-point for runq-exec\n\n* qemu\n  * creates `/var/lib/runq/qemu`\n  * read-only volume attached to every container\n  * contains qemu rootfs (proxy, qemu, kernel and initrd)\n\n* initrd\n  * prepares the initrd to boot the VM\n\n* pkg\n  * helper packages\n\n## runq-exec\n\nrunq-exec (`/var/lib/runq/runq-exec`) is a command line utility similar to **docker exec**. It allows running\nadditional commands in existing runq containers executed from the host. It uses\n[VirtioVsock](https://wiki.qemu.org/Features/VirtioVsock) for the communication\nbetween host and VMs. TLS is used for encryption and client authorization. Support for\n`runq-exec` can be disabled by setting the container environment variable `RUNQ_NOEXEC`\nto a true value or by `--noexec` in [/etc/docker/daemon.json](test/testdata/daemon.json).\n\n```text\nUsage:\n  runq-exec [options] \u003ccontainer\u003e command args\n\nRun a command in a running runq container\n\nOptions:\n  -c, --tlscert string    TLS certificate file (default \"/var/lib/runq/cert.pem\")\n  -k, --tlskey string     TLS private key file (default \"/var/lib/runq/key.pem\")\n  -e, --env stringArray   Set environment variables for command\n  -h, --help              Print this help\n  -i, --interactive       Keep STDIN open even if not attached\n  -t, --tty               Allocate a pseudo-TTY\n  -v, --version           Print version\n\nEnvironment Variable:\n  DOCKER_HOST    specifies the Docker daemon socket.\n\nExample:\n  runq-exec -ti a6c3b7c bash\n```\n\n## Qemu and guest Kernel\n\nrunq runs Qemu and Linux Kernel from the `/var/lib/runq/qemu` directory\non the host. This directory is populated by `make -C qemu`. For simplicity\nQemu and the Linux kernel are taken from the Ubuntu 20.04 LTS Docker base image.\nSee [qemu/x86_64/Dockerfile](qemu/x86_64/Dockerfile) for details.\nThis makes runq independent of the Linux distribution on the host.\nQemu does not need to be installed on the host.\n\nThe kernel modules directory (`/var/lib/runq/qemu/lib/modules`)\nis `bind-mounted` into every container to `/lib/modules`.\nThis allows the loading of extra kernel modules in any container if needed.\nFor this SYS_MODULES capability is required (`--cap-add sys_modules`).\n\n## Networking\n\nrunq uses Macvtap devices to connect Qemu VirtIO interfaces to Docker\nbridges. By default a single Ethernet interface is created.\nMultiple networks can be used by connecting a container to the networks\nbefore start. See [test/integration/net.sh](test/integration/net.sh) as an\nexample.\n\nrunq container can also be connected to one or more Docker networks of type Macvlan.\nThis allows a direct connection between the VM and the physical host network\nwithout bridge and without NAT. See \u003chttps://docs.docker.com/network/macvlan/\u003e for details.\n\nFor custom networks the docker daemon implements an embedded DNS server which provides\nbuilt-in service discovery for any container created with a valid container name.\nThis Docker DNS server (listen address 127.0.0.11:53) is reachable only by runc containers\nand not by runq containers.\nA work-around is to run one or more DNS proxy container in the custom network with runc and\nuse the proxy IP address for DNS of runq containers.\nSee [test/examples/dnsproxy.sh](test/examples/dnsproxy.sh) for details on how to setup a DNS proxy.\n\nDNS configuration without proxy can be done globally via runtime options specified in\n'/etc/docker/daemon.json' (see example above) or via environment variables for each\ncontainer at container start.\nThe environment variables are `RUNQ_DNS`, `RUNQ_DNS_OPT` and `RUNQ_DNS_SEARCH`.\nEnvironment variables have priority over global options.\n\nSetting the environment variable RUNQ_DNS_PRESERVE to \"1\" completely disables generation of\n/etc/resolv.conf by runq.\n\n## Storage\n\nExtra storage can be added in the form of Qcow2 images, raw file images or\nregular block devices. Storage devices will be mounted automatically if\na filesystem and a mount point has been specified.\nSupported filesystems are ext2, ext3, ext4, xfs and btrfs.\nCache type must be writeback, writethrough, none or unsafe.\nCache type \"none\" is recommended for filesystems that support `O_DIRECT`.\nSee man qemu(1) for details about different cache types.\n\nSyntax:\n\n```sh\n--volume \u003cimage  name\u003e:/dev/runq/\u003cid\u003e/\u003ccache type\u003e[/\u003cfilesystem type\u003e\u003cmount point\u003e]\n--device \u003cdevice name\u003e:/dev/runq/\u003cid\u003e/\u003ccache type\u003e[/\u003cfilesystem type\u003e\u003cmount point\u003e]\n```\n\n`\u003cid\u003e` is used to create symbolic links inside the VM guest that point to the Qemu Virtio device\nfiles. The `id` can be any character string that matches the regex pattern `\"^[a-zA-Z0-9-_]{1,36}$\"`\nbut it must be unique within a container.\n\n```sh\n/dev/disk/by-runq-id/0001 -\u003e ../../vda\n```\n\n### Storage examples\n\nMount the existing Qcow image `/data.qcow2` with xfs filesystem to `/mnt/data`:\n\n```sh\ndocker run -v /data.qcow2:/dev/runq/0001/none/xfs/mnt/data ...\n```\n\nAttach the host device `/dev/sdb1` formatted with ext4 to `/mnt/data2`:\n\n```sh\ndocker run --device /dev/sdb1:/dev/runq/0002/writethrough/ext4/mnt/data2 ...\n```\n\nAttach the host device `/dev/sdb2` without mounting:\n\n```sh\ndocker run --device /dev/sdb2:/dev/runq/0003/writethrough ...\n```\n\n### Rootdisk\n\nA block device or a raw file with an EXT2 or EXT4 filesystem can be used as rootdisk\nof the VM. On first boot of the container the content of the Docker image is copied into the rootdisk.\nThe block device or raw file will then be used as root filesystem via virtio-blk instead of 9pfs. But be aware that changes to the root filesystem will not be reflected in the source docker container filesystem. (`docker cp` will no longer work as expected)\n\n```sh\n# existing block device with empty ext4 filesystem\ndocker run --runtime runq --device /dev/sdb1:/dev/runq/0001/none/ext4 -e RUNQ_ROOTDISK=0001 -ti alpine sh\n\n# new raw file\nfallocate -l 1G disk.raw\nmkfs.ext4 disk.raw\ndocker run --runtime runq --volume $PWD/disk.raw:/dev/runq/0001/none/ext4 -e RUNQ_ROOTDISK=0001 -ti alpine sh\n```\n\nDirectories can be excluded from being copied with the RUNQ_ROOTDISK_EXCLUDE environment\nvariable. E.g. `-e RUNQ_ROOTDISK_EXCLUDE=\"/foo,/bar\"`\n\nSee [Dockerfile.rootdisk](test/examples/Dockerfile.rootdisk) and [rootdisk.sh](test/examples/rootdisk.sh) as a further example.\n\n## Capabilities\n\nBy default runq drops all capabilities except those needed (same as regular Docker does).\nThe white list of the remaining capabilities is provided by the Docker engine.\n\n`AUDIT_WRITE CHOWN DAC_OVERRIDE FOWNER FSETID KILL MKNOD NET_BIND_SERVICE\nNET_RAW SETFCAP SETGID SETPCAP SETUID SYS_CHROOT`\n\nSee `man capabilities` for a list of all available capabilities.\nAdditional Capabilities can be added to the white list at container start:\n\n```sh\ndocker run --cap-add SYS_TIME --cap-add SYS_MODULE ...`\n```\n\n## Seccomp\n\nrunq supports the [default Docker seccomp profile](https://github.com/docker/docker-ce/blob/master/components/engine/profiles/seccomp/default.json) as well as custom profiles.\n\n```sh\ndocker run --security-opt seccomp=\u003cprofile-file\u003e ...\n```\n\nThe default profile is defined by the Docker daemon and gets applied automatically.\nNote: Only the runq init binary is statically linked against libseccomp.\nTherefore libseccomp is needed only at compile time.\n\nIf the host operating system where runq is being built does not provide static libseccomp\nlibraries one can also simply build and install [libseccomp](https://github.com/seccomp/libseccomp/)\nfrom the sources.\n\nSeccomp can be disabled at container start:\n\n```sh\ndocker run --security-opt seccomp=unconfined ...\n```\n\nNote: Some Docker daemon don't support custom Seccomp profiles. Run `docker info` to verify\nthat Seccomp is supported by your daemon. If it is supported the output of `docker info` looks like this:\n\n```text\nSecurity Options:\n seccomp\n  Profile: default\n```\n\n## AP adapter passthrough (s390x only)\n\nAP devices provide cryptographic functions to all CPUs assigned to a Linux system running in\nan IBM Z system LPAR. AP devices can be made available to a runq container by passing a VFIO mediated\ndevice from the host through Qemu into the runq VM guest. VFIO mediated devices are enabled by the\n`vfio_ap` kernel module and allow for partitioning of AP devices and domains. The environment variable RUNQ_APUUID specifies the VFIO mediated device UUID. runq automatically loads the required zcrypt kernel modules inside the VM. E.g.:\n\n```sh\ndocker run --runtime runq -e RUNQ_APUUID=b34543ee-496b-4769-8312-83707033e1de ...\n```\n\nFor details on how to setup mediated devices on the host see\n\u003chttps://www.kernel.org/doc/html/latest/s390/vfio-ap.html\u003e\n\n## Limitations\n\nMost docker commands and options work as expected. However, due to\nthe fact that the target application runs inside a Qemu VM which itself runs\ninside a Docker container and because of the minimalistic design principle of runq\nsome docker commands and options don't work. E.g:\n\n* adding / removing networks and storage dynamically\n* docker exec (see runq-exec)\n* docker swarm\n* privileged mode\n* apparmor, selinux, ambient\n* docker HEALTHCHECK\n\nThe following common options of `docker run` are supported:\n\n```text\n--attach                    --name\n--cap-add                   --network\n--cap-drop                  --publish\n--cpus                      --restart\n--cpuset-cpus               --rm\n--detach                    --runtime\n--entrypoint                --sysctl\n--env                       --security-opt seccomp=unconfined\n--env-file                  --security-opt no-new-privileges\n--expose                    --security-opt seccomp=\u003cfilter-file\u003e\n--group-add                 --tmpfs\n--help                      --tty\n--hostname                  --ulimit\n--init                      --user\n--interactive               --volume\n--ip                        --volumes-from\n--link                      --workdir\n--mount\n```\n\n### Nested VM\n\nA nested VM is a virtual machine that runs inside of a virtual machine. In plain KVM this feature is\nconsidered working but not meant for production use. Running KVM guests inside guests of other\nhypervisors such as VMware might not work as expected or might not work at all.\nHowever to try out runq in a VM guest the (experimental) runq runtime configuration parameter\n`--nestedvm` can be used. It modifies the parameters of the Qemu process.\n\n## Developing runq\n\nFor fast development cycles runq can be build on the host as follows:\n\n1. Prerequisites:\n\n    * Docker \u003e= 19.03.x-ce\n    * Go \u003e= 1.20\n    * `/var/lib/runq` must be writable by the current user\n    * [Libseccomp](https://github.com/seccomp/libseccomp/) static library.\n    E.g. `libseccomp-dev` for Ubuntu or `libseccomp-static` for Fedora\n\n1. Download runq and runc source code\n\n    ```sh\n    git clone --recurse-submodules https://github.com/gotoz/runq.git\n    ```\n\n1. Install Qemu and guest kernel to `/var/lib/runq/qemu`.\n   All files are taken from the Ubuntu 20.04 LTS Docker base image. (`/var/lib/runq` must be writeable by the current user.)\n\n    ```sh\n    cd runq\n    make -C qemu all install\n    ```\n\n1. Compile and install runq components to `/var/lib/runq`\n\n    ```sh\n    make install\n    ```\n\n1. Create TLS certificates\n\n    ```sh\n    /var/lib/runq/qemu/mkcerts.sh\n    ```\n\n1. Adjust file and directory permissions\n\n    ```sh\n    sudo chown -R root:root /var/lib/runq\n    ```\n\n1. Register runq as Docker runtime with appropriate defaults as shown in section *Installation* above.\n\n## Contributing\n\nSee [CONTRIBUTING](CONTRIBUTING.md) for details.\n\n## License\n\nThe code is licensed under the Apache License 2.0.\n\nSee [LICENSE](LICENSE) for further details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgotoz%2Frunq","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgotoz%2Frunq","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgotoz%2Frunq/lists"}