Container Runtime Interface (CRI)
The Container Runtime Interface (CRI) is a plugin API that lets Kubernetes work with any container runtime, as long as it implements the CRI standard.
Why CRI Exists
Originally, Kubernetes was tightly coupled with Docker. As the ecosystem grew, other runtimes appeared. The CRI was created to:
| Problem |
CRI Solution |
| Kubernetes was locked to Docker |
CRI provides a standard interface for any runtime |
| Adding new runtimes required changing Kubernetes code |
New runtimes just implement the CRI API |
| Docker had unnecessary overhead for K8s use case |
Lighter runtimes (containerd, CRI-O) are more efficient |
The Runtime Stack
┌─────────────────────────────────────────────┐
│ kubelet │
│ (Node Agent) │
└──────────────────┬──────────────────────────┘
│ CRI (gRPC API)
▼
┌─────────────────────────────────────────────┐
│ Container Runtime │
│ (containerd or CRI-O) │
└──────────────────┬──────────────────────────┘
│ OCI Runtime Spec
▼
┌─────────────────────────────────────────────┐
│ Low-Level Runtime (runc) │
│ (Actually creates the container) │
└─────────────────────────────────────────────┘
Three Layers
| Layer |
Component |
What It Does |
| Top |
kubelet |
Tells the runtime what to do via CRI |
| Middle |
containerd / CRI-O |
Manages container lifecycle, image pulling |
| Bottom |
runc |
Creates the actual container (Linux namespaces, cgroups) |
Key Container Runtimes
containerd
| Aspect |
Details |
| What it is |
Industry-standard container runtime |
| Origin |
Extracted from Docker, donated to CNCF |
| CNCF status |
Graduated |
| Used by |
EKS, GKE, most K8s distributions |
| Key feature |
Lightweight, production-proven, CRI-native |
CRI-O
| Aspect |
Details |
| What it is |
Lightweight container runtime built specifically for Kubernetes |
| Origin |
Created by Red Hat |
| CNCF status |
Graduated |
| Used by |
OpenShift, some enterprise distributions |
| Key feature |
Minimal — does only what K8s needs, nothing more |
Docker (Removed in v1.24)
| Aspect |
Details |
| What happened |
Kubernetes removed the dockershim in v1.24 (2022) |
| Why |
Docker uses its own API (not CRI). The dockershim adapter added unnecessary complexity. |
| Impact |
Docker images still work. Only Docker as a runtime was removed. |
| What to use instead |
containerd (which was always inside Docker anyway) |
Before v1.24: kubelet → dockershim → Docker → containerd → runc
After v1.24: kubelet → containerd → runc (Direct, no Docker needed)
OCI — Open Container Initiative
The OCI defines industry standards for container formats and runtimes:
| Standard |
What It Defines |
| OCI Image Spec |
How container images are structured (layers, manifests) |
| OCI Runtime Spec |
How a container is created and run (implemented by runc) |
| OCI Distribution Spec |
How images are pushed/pulled from registries |
Why OCI matters for KCNA:
- Images built with Docker follow the OCI Image Spec
- This means Docker images work with containerd, CRI-O, and any OCI-compliant runtime
- The removal of Docker from Kubernetes didn’t break any images
CRI vs CNI vs CSI
Kubernetes uses three key plugin interfaces. Don’t confuse them:
| Interface |
Full Name |
What It Standardizes |
| CRI |
Container Runtime Interface |
How kubelet talks to container runtimes |
| CNI |
Container Network Interface |
How pods get their network connectivity |
| CSI |
Container Storage Interface |
How pods access persistent storage |
kubelet → CRI → containerd (runs containers)
→ CNI → Calico/Cilium (configures networking)
→ CSI → EBS/Ceph (attaches storage)
Image Pulling Process
When a pod is scheduled on a node:
| Step |
Component |
Action |
| 1 |
kubelet |
Receives pod spec from API server |
| 2 |
kubelet |
Calls CRI to create the pod sandbox |
| 3 |
Container runtime |
Checks if the image is already cached |
| 4 |
Container runtime |
If not cached, pulls from the container registry |
| 5 |
Container runtime |
Creates the container using OCI runtime (runc) |
| 6 |
kubelet |
Reports container status back to API server |
Image Pull Policies
| Policy |
Behavior |
| Always |
Pull the image every time (default for :latest tag) |
| IfNotPresent |
Pull only if the image isn’t already on the node |
| Never |
Never pull — image must already exist on the node |
Key Takeaways for the Exam
- CRI is the API standard between kubelet and container runtimes
- containerd and CRI-O are the two main CRI-compliant runtimes (both CNCF Graduated)
- Docker was removed as a runtime in Kubernetes v1.24 — Docker images still work via OCI compatibility
- The stack is: kubelet → CRI → containerd/CRI-O → runc
- OCI defines image and runtime standards — ensuring portability across runtimes
- Don’t confuse: CRI (runtime) vs CNI (networking) vs CSI (storage)
- runc is the low-level runtime that creates containers using Linux namespaces and cgroups
What’s Next?
Test your understanding of Kubernetes Architecture with practice questions.
Architecture Practice Questions →
