Container Runtimes
A container runtime is the software that actually creates and manages containers. Understanding the runtime ecosystem is essential for the KCNA.
The Runtime Hierarchy
┌────────────────────┐
│ kubelet │
│ (Kubernetes agent)│
└────────┬───────────┘
│ CRI (gRPC)
▼
┌──────────────────────────────┐
│ High-Level Runtime │
│ (containerd or CRI-O) │
│ - Image management │
│ - Container lifecycle │
│ - Networking setup │
└──────────────┬───────────────┘
│ OCI Runtime Spec
▼
┌──────────────────────────────┐
│ Low-Level Runtime │
│ (runc, crun, gVisor, Kata) │
│ - Create namespaces │
│ - Set up cgroups │
│ - Start the process │
└──────────────────────────────┘
High-Level Runtimes
Docker
| Aspect |
Details |
| What it is |
The original container platform that popularized containers |
| K8s status |
Removed as a Kubernetes runtime in v1.24 (dockershim deprecated) |
| Still relevant? |
Yes — for building images and local development. Images built with Docker work everywhere. |
containerd
| Aspect |
Details |
| What it is |
Industry-standard container runtime |
| Origin |
Extracted from Docker, donated to CNCF |
| CNCF status |
Graduated |
| K8s integration |
Native CRI support — the most widely used K8s runtime |
| Used by |
EKS, GKE, AKS, most K8s distributions |
CRI-O
| Aspect |
Details |
| What it is |
Lightweight runtime built specifically for Kubernetes |
| Origin |
Created by Red Hat |
| CNCF status |
Graduated |
| K8s integration |
CRI-native — designed to do exactly what Kubernetes needs and nothing more |
| Used by |
OpenShift |
Comparison
| Feature |
Docker |
containerd |
CRI-O |
| CRI support |
Via dockershim (removed) |
Native |
Native |
| Image building |
Yes (Dockerfile) |
No (use buildkit, kaniko) |
No |
| K8s runtime |
No (since v1.24) |
Yes |
Yes |
| CNCF project |
No |
Graduated |
Graduated |
| Footprint |
Largest |
Medium |
Smallest |
Low-Level Runtimes
| Runtime |
What It Does |
Key Feature |
| runc |
Default OCI runtime — creates containers using Linux primitives |
Standard, used by containerd and CRI-O |
| crun |
Fast, lightweight OCI runtime written in C |
Performance-optimized |
| gVisor |
Application kernel for containers |
Extra security — intercepts syscalls |
| Kata Containers |
Lightweight VMs that look like containers |
VM-level isolation with container UX |
OCI Standards
The Open Container Initiative defines three standards:
| Standard |
What It Defines |
Why It Matters |
| OCI Image Spec |
How container images are structured |
Images built by Docker work with containerd, CRI-O, etc. |
| OCI Runtime Spec |
How containers are created and run |
runc implements this spec |
| OCI Distribution Spec |
How images are stored and distributed |
Registries follow this standard |
Container Registries
Registries store container images:
| Registry |
Type |
Provider |
| Docker Hub |
Public/Private |
Docker Inc. |
| Amazon ECR |
Private |
AWS |
| Google Artifact Registry |
Private |
Google Cloud |
| Azure Container Registry |
Private |
Microsoft Azure |
| GitHub Container Registry |
Public/Private |
GitHub |
| Harbor |
Self-hosted, Open-source |
CNCF (Graduated) |
Harbor is a CNCF Graduated project — know it as the cloud-native, open-source container registry.
Key Takeaways for the Exam
- containerd and CRI-O are the two main Kubernetes container runtimes (both CNCF Graduated)
- Docker was removed as a K8s runtime in v1.24 — Docker images still work via OCI compatibility
- The runtime stack: kubelet → CRI → containerd/CRI-O → runc
- runc is the default low-level runtime that creates containers using Linux namespaces and cgroups
- OCI standards ensure portability — images and runtimes are interchangeable
- Harbor is the CNCF Graduated open-source container registry
- Docker is still used for building images — just not as a Kubernetes runtime
What’s Next?
Let’s explore how containers communicate in a networked environment.
Container Networking →
