diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
new file mode 100644
index 0000000..ca3370b
--- /dev/null
+++ b/.github/workflows/goreleaser.yml
@@ -0,0 +1,33 @@
+name: goreleaser
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Set up environment variables
+        run: |
+          echo "VERSION=$(git describe --tags $(git rev-list --tags --max-count=1))" >> $GITHUB_ENV
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.15
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v2
+        with:
+          version: latest
+          args: release --rm-dist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a46707c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+vendor/
+docker-cni
+dist/
diff --git a/.goreleaser.yml b/.goreleaser.yml
new file mode 100644
index 0000000..3e78870
--- /dev/null
+++ b/.goreleaser.yml
@@ -0,0 +1,37 @@
+before:
+  hooks:
+    - go mod download
+
+builds:
+  - binary: docker-cni
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -X main.REVISION={{.Commit}}
+      - -X main.VERSION={{.Env.VERSION}}
+      - -X main.BUILTAT={{.Date}}
+    goos:
+      - linux
+    goarch:
+      - amd64
+
+archives:
+  - replacements:
+      linux: Linux
+      amd64: x86_64
+
+checksum:
+  name_template: 'checksums.txt'
+
+release:
+  prerelease: auto
+
+snapshot:
+  name_template: "{{ .Tag }}-next"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..3055f79
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,17 @@
+.PHONY: binary
+
+REVISION := $(shell git rev-parse HEAD || unknown)
+BUILTAT := $(shell date +%Y-%m-%dT%H:%M:%S)
+VERSION := $(shell git describe --tags $(shell git rev-list --tags --max-count=1))
+GO_LDFLAGS ?= -X main.REVISION=$(REVISION) \
+			  -X main.BUILTAT=$(BUILTAT) \
+			  -X main.VERSION=$(VERSION)
+
+deps:
+	env GO111MODULE=on go mod download
+	env GO111MODULE=on go mod vendor
+
+binary:
+	CGO_ENABLED=0 go build -ldflags "$(GO_LDFLAGS)" -o docker-cni
+
+build: deps binary
diff --git a/README.md b/README.md
index 0ea3e66..3a8c427 100644
--- a/README.md
+++ b/README.md
@@ -2,12 +2,78 @@
 
 This repo aims to integrate [CNI](https://github.com/containernetworking/cni) with Dockerd.
 
-There is, [according to CNI repo](https://github.com/containernetworking/cni/blob/master/scripts/docker-run.sh), an approach to integrate by running a [pause] equivalent container ahead of the application container, but that's too pod-like for those who resent pod models.
+There is, [according to CNI repo](https://github.com/containernetworking/cni/blob/master/scripts/docker-run.sh), an approach to integrate by running a [pause](https://groups.google.com/g/kubernetes-users/c/jVjv0QK4b_o) equivalent container ahead of the application container, but that's too pod-like for those who resent pod models.
 
 Let's figure out yet another solution.
 
 # Usage
 
+## 0. Prepare your CNI plugin
+
+Make sure you have everything ready:
+
+1. CNI binaries in the right place: for example, `/opt/cni/bin/calico` and `/opt/cni/bin/calico-ipam` binaries
+2. CNI configures in the right place: for exmaple, `/etc/cni/net.d/10-calico.conf`
+3. Other services needed: for example, `calico-node` container
+
+Notes:
+
+1. Provided there are multiple CNI configures in the dir, `docker-cni` will only use the first config in alphabet order.
+
 ## 1. Configure docker-cni
 
+### 1.1 install docker-cni binary
+
+Download the latest binary from [release](https://github.com/projecteru2/docker-cni/releases).
+
+### 1.2 docker-cni configuration
+
+```shell
+mkdir -p /etc/docker/
+cat <<!
+cni_conf_dir: /etc/cni/net.d/
+cni_bin_dir: /opt/cni/bin/
+log_driver: file:///var/run/log/docker-cni.log
+log_level: debug
+!
+```
+
+You may revise the aforementioned configure with YOUR `cni_conf_dir` and `cni_bin_dir`.
+
 ## 2. Configure dockerd
+
+### 2.1 dockerd daemon configuration
+
+Add the additional `runtime` in docker daemon configure, which is usually located at `/etc/docker/daemon.json`:
+
+```
+{
+    ...
+    "runtimes": {
+        "cni": {
+            "path": "/usr/local/bin/docker-cni",
+            "runtimeArgs": [
+                "--config",
+                "/etc/docker/cni.yaml",
+                "--runtime-path",
+                "/usr/bin/runc",
+                "--"
+            ]
+        }
+    }
+}
+```
+
+### 2.2 restart dockerd
+
+```
+systemctl restart dockerd
+```
+
+## 3. Create docker container with CNI
+
+```
+docker run -td --runtime cni --net none bash bash
+```
+
+That's everything.
diff --git a/cni.yaml.example b/cni.yaml.example
new file mode 100644
index 0000000..7c62980
--- /dev/null
+++ b/cni.yaml.example
@@ -0,0 +1,4 @@
+cni_conf_dir: /etc/cni/net.d/
+cni_bin_dir: /opt/cni/bin/
+log_driver: file:///var/run/log/docker-cni.log
+log_level: debug
diff --git a/cni/netns.go b/cni/netns.go
new file mode 100644
index 0000000..89cfeb8
--- /dev/null
+++ b/cni/netns.go
@@ -0,0 +1,33 @@
+package cni
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/projecteru2/docker-cni/utils"
+)
+
+func (p netnsManager) GetNetns(ID string) (netnsPath string, err error) {
+	_, err = os.Stat(p.getNetnsPath(ID))
+	return p.getNetnsPath(ID), errors.WithStack(err)
+}
+
+func (p netnsManager) AddNetns(ID string) (netnsPath string, add, del *utils.Process, err error) {
+	if add, err = utils.NewProcess("ip", []string{"net", "a", p.getID(ID)}, nil, nil); err != nil {
+		return
+	}
+	del, err = p.DelNetns(ID)
+	return p.getNetnsPath(ID), add, del, err
+}
+
+func (p netnsManager) DelNetns(ID string) (*utils.Process, error) {
+	return utils.NewProcess("ip", []string{"net", "d", p.getID(ID)}, nil, nil)
+}
+
+func (p netnsManager) getNetnsPath(ID string) string {
+	return "/var/run/netns/" + p.getID(ID)
+}
+
+func (p netnsManager) getID(ID string) string {
+	return ID[:12]
+}
diff --git a/cni/network.go b/cni/network.go
new file mode 100644
index 0000000..d25fe24
--- /dev/null
+++ b/cni/network.go
@@ -0,0 +1,58 @@
+package cni
+
+import (
+	"github.com/pkg/errors"
+	"github.com/projecteru2/docker-cni/config"
+	"github.com/projecteru2/docker-cni/oci"
+	"github.com/projecteru2/docker-cni/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+// checkupNetwork checks the netns and invokes "CNI check" (not implemented yet)
+func (p *CNIPlugin) CheckupNetwork(conf config.Config, containerMeta *oci.ContainerMeta) (exist bool, cleanup []*utils.Process, err error) {
+	netnsPath, err := p.GetNetns(containerMeta.ID)
+	if err != nil {
+		return false, nil, err
+	}
+
+	delCNI, err := p.DelCNI(containerMeta.ID, netnsPath, DefaultIfname)
+	if err != nil {
+		return false, nil, errors.WithStack(err)
+	}
+	delNetns, err := p.DelNetns(containerMeta.ID)
+	if err != nil {
+		return false, nil, errors.WithStack(err)
+	}
+	return true, []*utils.Process{delCNI, delNetns}, nil
+}
+
+func (p *CNIPlugin) SetupNetwork(conf config.Config, containerMeta *oci.ContainerMeta) (netnsPath string, cleanup []*utils.Process, err error) {
+	netnsPath, addNetns, delNetns, err := p.AddNetns(containerMeta.ID)
+	if err != nil {
+		err = errors.WithStack(err)
+		return
+	}
+	if _, _, err = addNetns.Run(); err != nil {
+		err = errors.WithStack(err)
+		return
+	}
+	defer func() {
+		if err != nil {
+			if _, _, e := delNetns.Run(); e != nil {
+				log.Errorf("failed to rollback netns: %+v", e)
+			}
+		}
+	}()
+
+	addCNI, delCNI, err := p.AddCNI(containerMeta.ID, netnsPath, DefaultIfname)
+	if err != nil {
+		return
+	}
+	stdoutBytes, stderrBytes, err := addCNI.Run()
+	log.Infof("add cni stdout: %s", string(stdoutBytes))
+	log.Debugf("add cni stderr: %s", string(stderrBytes))
+	return netnsPath, []*utils.Process{
+		delCNI,
+		delNetns,
+	}, err
+}
diff --git a/cni/operate.go b/cni/operate.go
new file mode 100644
index 0000000..88eae68
--- /dev/null
+++ b/cni/operate.go
@@ -0,0 +1,43 @@
+package cni
+
+import (
+	"github.com/projecteru2/docker-cni/utils"
+)
+
+func (p *CNIPlugin) addCNI(ID, netnsPath, ifname string) (*utils.Process, error) {
+	return utils.NewProcess(
+		p.binPath, // path
+		nil,       // args
+		[]string{
+			"CNI_COMMAND=ADD",
+			"CNI_CONTAINERID=" + ID,
+			"CNI_NETNS=" + netnsPath,
+			"CNI_IFNAME=" + ifname,
+			"CNI_PATH=" + p.binDir,
+		}, // env
+		utils.NewStdio(p.specBytes), // stdio
+	)
+}
+
+func (p *CNIPlugin) DelCNI(ID, netnsPath, ifname string) (*utils.Process, error) {
+	return utils.NewProcess(
+		p.binPath, // path
+		nil,       // args
+		[]string{
+			"CNI_COMMAND=DEL",
+			"CNI_CONTAINERID=" + ID,
+			"CNI_NETNS=" + netnsPath,
+			"CNI_IFNAME=" + ifname,
+			"CNI_PATH=" + p.binDir,
+		}, // env
+		utils.NewStdio(p.specBytes), // stdio
+	)
+}
+
+func (p *CNIPlugin) AddCNI(ID, netnsPath, ifname string) (add, del *utils.Process, err error) {
+	if add, err = p.addCNI(ID, netnsPath, ifname); err != nil {
+		return
+	}
+	del, err = p.DelCNI(ID, netnsPath, ifname)
+	return
+}
diff --git a/cni/types.go b/cni/types.go
new file mode 100644
index 0000000..ceaead6
--- /dev/null
+++ b/cni/types.go
@@ -0,0 +1,58 @@
+package cni
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"path/filepath"
+	"sort"
+
+	"github.com/pkg/errors"
+)
+
+const (
+	DefaultIfname = "eth0"
+)
+
+type CNIPlugin struct {
+	netnsManager
+
+	binDir    string
+	binPath   string
+	specBytes []byte
+}
+
+type CNISpec struct {
+	Type string `json:"type"`
+}
+
+func NewCNIPlugin(specDir, binDir string) (_ *CNIPlugin, err error) {
+	// walk thu the config_dir and get the first configure file in lexicographic order, the same behavior as kubelet: https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#cni
+
+	files, err := ioutil.ReadDir(specDir)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	if len(files) == 0 {
+		return nil, errors.Errorf("cni configure not found: %s", specDir)
+	}
+
+	sort.Slice(files, func(i, j int) bool { return files[i].Name() < files[j].Name() })
+	content, err := ioutil.ReadFile(filepath.Join(specDir, files[0].Name()))
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	spec := &CNISpec{}
+	if err = json.Unmarshal(content, spec); err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	return &CNIPlugin{
+		binDir:    binDir,
+		binPath:   filepath.Join(binDir, spec.Type),
+		specBytes: content,
+	}, nil
+}
+
+type netnsManager struct{}
diff --git a/config/log.go b/config/log.go
new file mode 100644
index 0000000..d67c594
--- /dev/null
+++ b/config/log.go
@@ -0,0 +1,53 @@
+package config
+
+import (
+	"io"
+	"os"
+	"strings"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+func (c *Config) SetupLog() (err error) {
+	level, err := log.ParseLevel(c.LogLevel)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	log.SetLevel(level)
+
+	formatter := &log.TextFormatter{
+		ForceColors:     true,
+		TimestampFormat: "2006-01-02 15:04:05",
+		FullTimestamp:   true,
+	}
+	log.SetFormatter(formatter)
+	logger, err := getLogger(c.LogDriver)
+	if err != nil {
+		return err
+	}
+	log.SetOutput(logger)
+	return
+}
+
+func getLogger(driver string) (io.Writer, error) {
+	switch {
+	case strings.HasPrefix(driver, "file://"):
+		return newFileLogger(strings.TrimPrefix(driver, "file://"))
+	}
+	return newFileLogger("/dev/null")
+}
+
+type fileLogger struct {
+	*os.File
+}
+
+func newFileLogger(filePath string) (*fileLogger, error) {
+	file, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0666)
+	return &fileLogger{file}, errors.WithStack(err)
+}
+
+func (l *fileLogger) Write(p []byte) (int, error) {
+	written, err := l.File.Write(p)
+	return written, errors.WithStack(err)
+}
diff --git a/config/types.go b/config/types.go
new file mode 100644
index 0000000..dfb9599
--- /dev/null
+++ b/config/types.go
@@ -0,0 +1,40 @@
+package config
+
+import (
+	"io/ioutil"
+
+	"github.com/pkg/errors"
+	"gopkg.in/yaml.v2"
+)
+
+type Config struct {
+	CNIConfDir string `yaml:"cni_conf_dir" default:"/etc/cni/net.d/"`
+	CNIBinDir  string `yaml:"cni_bin_dir" default:"/opt/cni/bin/"`
+	LogDriver  string `yaml:"log_driver" default:"file:///var/run/log/docker-cni.log"`
+	LogLevel   string `yaml:"log_level" default:"info"`
+
+	// from command line args
+	OCISpecFilename string
+	ID              string
+}
+
+func LoadConfig(path string) (config Config, err error) {
+	data, err := ioutil.ReadFile(path)
+	if err != nil {
+		return config, errors.WithStack(err)
+	}
+	if err = yaml.Unmarshal(data, &config); err != nil {
+		return config, errors.WithStack(err)
+	}
+	return
+}
+
+func (c Config) Validate() error {
+	if c.OCISpecFilename == "" {
+		return errors.Errorf("invalid config: oci spec filename is required")
+	}
+	if c.ID == "" {
+		return errors.Errorf("invalid config: container ID is required")
+	}
+	return nil
+}
diff --git a/create.go b/create.go
new file mode 100644
index 0000000..a8e75d1
--- /dev/null
+++ b/create.go
@@ -0,0 +1,66 @@
+package main
+
+import (
+	"os"
+
+	"github.com/projecteru2/docker-cni/cni"
+	"github.com/projecteru2/docker-cni/config"
+	"github.com/projecteru2/docker-cni/oci"
+	"github.com/projecteru2/docker-cni/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+func handleCreate(conf config.Config) (rollback func(), err error) {
+	containerMeta, err := oci.LoadContainerMeta(conf.ID, conf.OCISpecFilename)
+	if err != nil {
+		return nil, err
+	}
+	cniPlug, err := cni.NewCNIPlugin(conf.CNIConfDir, conf.CNIBinDir)
+	if err != nil {
+		return
+	}
+	netnsPath, cleanup, err := cniPlug.SetupNetwork(conf, containerMeta)
+	if err != nil {
+		return nil, err
+	}
+	rollback = func() {
+		for _, clean := range cleanup {
+			if _, _, e := clean.Run(); e != nil {
+				log.Errorf("failed to rollback %s: %+v", clean.String(), e)
+			}
+		}
+	}
+	defer func() {
+		if err != nil {
+			rollback()
+		}
+	}()
+	return rollback, updateContainerMeta(containerMeta, netnsPath, cleanup)
+
+}
+
+func updateContainerMeta(containerMeta *oci.ContainerMeta, netnsPath string, cleanup []*utils.Process) (err error) {
+	containerMeta.UpdateNetns(netnsPath)
+	for _, clean := range cleanup {
+		containerMeta.AppendPoststopHook(clean)
+	}
+	return containerMeta.Save()
+}
+
+func runOCI(ociPath string, ociArgs []string) (err error) {
+	proc, err := utils.NewProcess(ociPath, ociArgs,
+		nil,                 // env
+		utils.NewStdio(nil), // stdio
+	)
+	if err != nil {
+		return
+	}
+	stdoutBytes, stderrBytes, err := proc.Run()
+	if _, e := os.Stdout.Write(stdoutBytes); e != nil {
+		log.Errorf("failed to forward stdout from oci runtime: %+v", e)
+	}
+	if _, e := os.Stderr.Write(stderrBytes); e != nil {
+		log.Errorf("failed to forward stderr from oci runtime: %+v", e)
+	}
+	return err
+}
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..6882d06
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,12 @@
+module github.com/projecteru2/docker-cni
+
+go 1.15
+
+require (
+	github.com/opencontainers/runtime-spec v1.0.2
+	github.com/pkg/errors v0.9.1
+	github.com/sirupsen/logrus v1.8.1
+	github.com/spf13/pflag v1.0.5
+	golang.org/x/sys v0.0.0-20200217220822-9197077df867 // indirect
+	gopkg.in/yaml.v2 v2.4.0
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..761e104
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,22 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=
+github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867 h1:JoRuNIf+rpHl+VhScRQQvzbHed86tKkqwPMV34T8myw=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
diff --git a/main.go b/main.go
new file mode 100644
index 0000000..715c454
--- /dev/null
+++ b/main.go
@@ -0,0 +1,123 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	flag "github.com/spf13/pflag"
+
+	"github.com/projecteru2/docker-cni/config"
+	"github.com/projecteru2/docker-cni/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+type OCIPhase int
+
+const (
+	CreatePhase OCIPhase = iota
+	StartPhase
+	KillPhase
+	DeletePhase
+	OtherPhase
+)
+
+func main() {
+	var err error
+	defer func() {
+		os.Exit(utils.ParseExitCode(err))
+	}()
+
+	version, configPath, ociPath, ociArgs := parseArgs()
+	if err != nil {
+		log.Errorf("invalid arguments: %+v", err)
+		return
+	}
+	if version {
+		printVersion()
+		return
+	}
+
+	conf, err := setup(configPath, ociArgs)
+	if err != nil {
+		log.Errorf("failed to setup: %+v", err)
+		return
+	}
+
+	log.Infof("docker-cni running: %+v", os.Args)
+	defer log.Infof("docker-cni finishing: %+v", err)
+
+	var rollback func()
+	switch parsePhase(ociArgs) {
+
+	case CreatePhase:
+		if rollback, err = handleCreate(conf); err != nil {
+			log.Errorf("failed to handle create: %+v", err)
+			return
+		}
+
+	case StartPhase:
+		if rollback, err = handleStart(conf); err != nil {
+			log.Errorf("failed to handle start: %+v", err)
+			return
+		}
+	}
+	if rollback != nil {
+		defer func() {
+			if err != nil {
+				rollback()
+			}
+		}()
+	}
+
+	err = runOCI(ociPath, ociArgs)
+}
+
+func parsePhase(args []string) OCIPhase {
+	for _, arg := range args {
+		switch arg {
+		case "create":
+			return CreatePhase
+		case "start":
+			return StartPhase
+		case "kill":
+			return KillPhase
+		case "delete":
+			return DeletePhase
+		}
+	}
+	return OtherPhase
+}
+
+func parseArgs() (version bool, configPath, ociPath string, ociArgs []string) {
+	flag.BoolVarP(&version, "version", "v", false, "version message")
+	flag.StringVar(&configPath, "config", "/etc/docker/cni.yaml", "docker-cni configure path")
+	flag.StringVar(&ociPath, "runtime-path", "/usr/bin/runc", "oci runtime path")
+	flag.Parse()
+	return version, configPath, ociPath, flag.Args()
+}
+
+func setup(configPath string, ociArgs []string) (conf config.Config, err error) {
+	if conf, err = config.LoadConfig(configPath); err != nil {
+		return
+	}
+
+	for i, args := range ociArgs {
+		if args == "--bundle" {
+			conf.OCISpecFilename = filepath.Join(ociArgs[i+1], "config.json")
+		}
+		if args == "--log" && conf.OCISpecFilename == "" {
+			conf.OCISpecFilename = filepath.Join(filepath.Dir(ociArgs[i+1]), "config.json")
+		}
+		if len(args) == 64 && !strings.Contains(args, "/") { // shit, I hate this
+			conf.ID = args
+		}
+	}
+
+	if err = conf.SetupLog(); err != nil {
+		return
+	}
+
+	log.Debugf("config: %+v", conf)
+	return conf, conf.Validate()
+}
diff --git a/oci/container.go b/oci/container.go
new file mode 100644
index 0000000..1af94c7
--- /dev/null
+++ b/oci/container.go
@@ -0,0 +1,52 @@
+package oci
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"strings"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
+	"github.com/projecteru2/docker-cni/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+func (c *ContainerMeta) Labels() map[string]string {
+	return nil
+}
+
+func (c *ContainerMeta) UpdateNetns(netnsPath string) {
+	for idx, ns := range c.Linux.Namespaces {
+		if ns.Type == specs.NetworkNamespace {
+			if ns.Path != "" {
+				log.Warnf("netns path existed and have been replaced: %s", ns.Path)
+			}
+			c.Linux.Namespaces[idx] = specs.LinuxNamespace{
+				Type: specs.NetworkNamespace,
+				Path: netnsPath,
+			}
+		}
+	}
+}
+
+func (c *ContainerMeta) AppendPoststopHook(process *utils.Process) {
+	cmd := fmt.Sprintf("%s %s", process.Path, strings.Join(process.Args, " "))
+	if process.Stdio != nil && process.Stdio.StdinBytes != nil {
+		cmd += " <<<'" + strings.ReplaceAll(strings.ReplaceAll(string(process.StdinBytes), "\n", ""), " ", "") + "'"
+	}
+	c.Hooks.Poststop = append(c.Hooks.Poststop, specs.Hook{
+		Path: "/bin/bash",
+		Args: []string{"bash", "-c", cmd},
+		Env:  process.Env,
+	})
+}
+
+func (c *ContainerMeta) Save() (err error) {
+	data, err := json.Marshal(c.Spec)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	log.Debugf("save config")
+	return errors.WithStack(ioutil.WriteFile(c.BundlePath, data, 0644))
+}
diff --git a/oci/types.go b/oci/types.go
new file mode 100644
index 0000000..f64a642
--- /dev/null
+++ b/oci/types.go
@@ -0,0 +1,28 @@
+package oci
+
+import (
+	"encoding/json"
+	"io/ioutil"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
+)
+
+type ContainerMeta struct {
+	ID         string
+	BundlePath string
+	specs.Spec
+}
+
+func LoadContainerMeta(ID, bundlePath string) (*ContainerMeta, error) {
+	data, err := ioutil.ReadFile(bundlePath)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	containerMeta := &ContainerMeta{
+		ID:         ID,
+		BundlePath: bundlePath,
+	}
+	return containerMeta, json.Unmarshal(data, &containerMeta.Spec)
+}
diff --git a/start.go b/start.go
new file mode 100644
index 0000000..1632512
--- /dev/null
+++ b/start.go
@@ -0,0 +1,32 @@
+package main
+
+import (
+	"github.com/pkg/errors"
+	"github.com/projecteru2/docker-cni/cni"
+	"github.com/projecteru2/docker-cni/config"
+	"github.com/projecteru2/docker-cni/oci"
+	log "github.com/sirupsen/logrus"
+)
+
+// handleStart merely generates rollback
+func handleStart(conf config.Config) (rollback func(), err error) {
+	containerMeta, err := oci.LoadContainerMeta(conf.ID, conf.OCISpecFilename)
+	if err != nil {
+		return
+	}
+	cniPlug, err := cni.NewCNIPlugin(conf.CNIConfDir, conf.CNIBinDir)
+	if err != nil {
+		return
+	}
+	exist, cleanup, err := cniPlug.CheckupNetwork(conf, containerMeta)
+	if !exist {
+		return nil, errors.Errorf("failed to checkup network: netns not exist")
+	}
+	return func() {
+		for _, clean := range cleanup {
+			if _, _, e := clean.Run(); e != nil {
+				log.Errorf("failed to rollback %s: %+v", clean.String(), e)
+			}
+		}
+	}, err
+}
diff --git a/utils/process.go b/utils/process.go
new file mode 100644
index 0000000..ba33ade
--- /dev/null
+++ b/utils/process.go
@@ -0,0 +1,136 @@
+package utils
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"os/signal"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+type Process struct {
+	Path string
+	Args []string
+	Env  []string
+	*Stdio
+
+	cmd *exec.Cmd
+}
+
+type Stdio struct {
+	StdinBytes []byte
+	Stdout     io.Reader
+	Stderr     io.Reader
+}
+
+func NewStdio(stdinBytes []byte) *Stdio {
+	stdio := &Stdio{
+		StdinBytes: stdinBytes,
+	}
+	return stdio
+}
+
+func (s *Stdio) Stdin() io.Reader {
+	if s == nil || s.StdinBytes == nil {
+		return os.Stdin
+	}
+	return bytes.NewReader(s.StdinBytes)
+}
+
+func (s *Stdio) StdoutBytes() []byte {
+	bs, err := ioutil.ReadAll(s.Stdout)
+	if err != nil {
+		log.Errorf("failed to read stdout: %+v", err)
+	}
+	return bs
+}
+
+func (s *Stdio) StderrBytes() []byte {
+	bs, err := ioutil.ReadAll(s.Stderr)
+	if err != nil {
+		log.Errorf("failed to read stderr: %+v", err)
+	}
+	return bs
+}
+
+func NewProcess(path string, args, env []string, stdio *Stdio) (_ *Process, err error) {
+	cmd := exec.Command(path, args...)
+	cmd.Stdin = stdio.Stdin()
+	cmd.Env = env
+
+	if stdio != nil {
+		stdio.Stdout, err = cmd.StdoutPipe()
+		if err != nil {
+			return nil, errors.WithStack(err)
+		}
+		stdio.Stderr, err = cmd.StderrPipe()
+		if err != nil {
+			return nil, errors.WithStack(err)
+		}
+	}
+
+	return &Process{
+		Path:  path,
+		Args:  args,
+		Env:   env,
+		Stdio: stdio,
+		cmd:   cmd,
+	}, nil
+}
+
+func (p *Process) Start() (err error) {
+	log.Debugf("spawning process %+v", p.cmd)
+	return errors.WithStack(p.cmd.Start())
+}
+
+func (p *Process) Wait() (err error) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go func() {
+		signals := make(chan os.Signal, 32)
+		signal.Notify(signals)
+		for {
+			select {
+			case sig := <-signals:
+				if e := p.cmd.Process.Signal(sig); e != nil {
+					log.Errorf("failed to forward signal: %s", sig.String())
+				}
+			case <-ctx.Done():
+				return
+			}
+
+		}
+	}()
+	return errors.WithStack(p.cmd.Wait())
+}
+
+func ParseExitCode(err error) int {
+	if err == nil {
+		return 0
+	}
+	if exit, ok := errors.Unwrap(err).(*exec.ExitError); ok {
+		return exit.ExitCode()
+	}
+	log.Warnf("failed to retrieve exit code: %+v", err)
+	return 1
+}
+
+func (p *Process) Run() (stdoutBytes, stderrBytes []byte, err error) {
+	if err = p.Start(); err != nil {
+		return
+	}
+	if p.Stdio != nil {
+		stdoutBytes, stderrBytes = p.Stdio.StdoutBytes(), p.Stdio.StderrBytes()
+	}
+	return stdoutBytes, stderrBytes, p.Wait()
+}
+
+func (p *Process) String() string {
+	return p.cmd.String()
+}
diff --git a/version.go b/version.go
new file mode 100644
index 0000000..28833cd
--- /dev/null
+++ b/version.go
@@ -0,0 +1,24 @@
+package main
+
+import (
+	"fmt"
+	"runtime"
+)
+
+var (
+	// VERSION is app version
+	VERSION = "unknown"
+	// REVISION is app revision
+	REVISION = "HEAD"
+	// BUILTAT is app built info
+	BUILTAT = "now"
+)
+
+func printVersion() {
+	fmt.Printf("Version:        %s\n", VERSION)
+	fmt.Printf("Git hash:       %s\n", REVISION)
+	fmt.Printf("Built:          %s\n", BUILTAT)
+	fmt.Printf("Golang version: %s\n", runtime.Version())
+	fmt.Printf("OS/Arch:        %s/%s\n", runtime.GOOS, runtime.GOARCH)
+
+}