CKA — Container Runtime
Container Runtime Interface (CRI)
Kubernetes uses the Container Runtime Interface (CRI) to communicate with any compatible container runtime. The runtime is responsible for pulling images and running containers.
| Runtime | Default In | CRI Support | Notes |
|---|---|---|---|
| containerd | Most distributions | Native | Industry standard |
| CRI-O | OpenShift | Native | Lightweight, K8s-only |
| Docker | Legacy (< 1.24) | Via cri-dockerd | Deprecated as direct runtime |
Prerequisites for Any Runtime
Before installing a container runtime, prepare the node:
Load Required Kernel Modules
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
sudo modprobe overlay
sudo modprobe br_netfilter
Configure Sysctl Parameters
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
sudo sysctl --system
Disable Swap
sudo swapoff -a
sudo sed -i '/ swap / s/^/#/' /etc/fstab
Install containerd
containerd is the recommended container runtime for Kubernetes.
# Install containerd
sudo apt-get update
sudo apt-get install -y containerd
# Create default configuration
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
# Enable SystemdCgroup (critical for kubeadm)
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
# Restart and enable
sudo systemctl restart containerd
sudo systemctl enable containerd
Important: Setting SystemdCgroup = true is mandatory. Without it, kubeadm will fail with cgroup driver mismatch errors.
Verify containerd
sudo systemctl status containerd
# Should show: active (running)
containerd vs CRI-O
| Aspect | containerd | CRI-O |
|---|---|---|
| Scope | General-purpose container runtime | Kubernetes-only runtime |
| Image format | OCI, Docker | OCI |
| Used by | Docker, Kubernetes, nerdctl | OpenShift, Kubernetes |
| CLI tools | ctr, nerdctl, crictl | crictl |
| Config file | /etc/containerd/config.toml | /etc/crio/crio.conf |
| Size | Larger (supports more use cases) | Smaller (focused on K8s) |
crictl — Container Runtime CLI
crictl is the standard CLI for interacting with any CRI-compatible runtime. Use it for node-level troubleshooting.
# List running containers
crictl ps
# List all containers (including stopped)
crictl ps -a
# List pods
crictl pods
# List images
crictl images
# Pull an image
crictl pull nginx:1.27
# View container logs
crictl logs <container-id>
# Inspect a container
crictl inspect <container-id>
# Execute into a container
crictl exec -it <container-id> sh
crictl vs kubectl
| Tool | Talks to | Scope | Use when |
|---|---|---|---|
| kubectl | API server | Cluster-wide | Normal operations |
| crictl | Container runtime | Node-local | API server is down, node troubleshooting |
Exam tip: If the API server is not responding and kubectl does not work, use crictl to inspect containers directly on the node.
Next: Install kubeadm →
