Skip to main content

Chapter 2.8 - Container Runtime

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand the role of the Container Runtime
  • Identify the different supported runtimes
  • Explain the CRI interface
  • Understand container isolation

What is a Container Runtime?​

The Container Runtime is the software responsible for running containers on a node. It manages the container lifecycle: creation, start, stop, deletion.

Container Runtime Interface (CRI)​

Kubernetes uses CRI to communicate with runtimes:

CRI Operations​

  • RunPodSandbox() - Create an isolated environment
  • CreateContainer() - Create a container
  • StartContainer() - Start a container
  • StopContainer() - Stop a container
  • RemoveContainer() - Remove a container

Supported Runtimes​

Modern, lightweight runtime, used by default in many distributions:

Advantages:

  • Lightweight and performant
  • Industry standard
  • Supports OCI (Open Container Initiative)

2. CRI-O​

Runtime optimized for Kubernetes:

Advantages:

  • Specifically designed for Kubernetes
  • Lightweight
  • OCI compliant

3. Docker (Deprecated)​

Docker via dockershim (deprecated since Kubernetes 1.24):

Note: Docker Engine can still be used, but via containerd.

Isolation and Security​

Linux Namespaces​

Containers use Linux namespaces for isolation:

Types of namespaces:

  • PID: Process isolation
  • Network: Network isolation
  • Mount: Filesystem isolation
  • UTS: Hostname isolation
  • IPC: Inter-process isolation
  • User: User isolation

Cgroups​

Resource limitation:

Container Lifecycle​

Container Images​

Image Pull​

The Container Runtime downloads images from registries:

Image Formats​

  • OCI: Open Container Initiative (standard)
  • Docker: Docker format (OCI compatible)

Useful Commands​

# View containers (if Docker)
docker ps

# View images
docker images

# View container logs
docker logs <container-id>

# Inspect a container
docker inspect <container-id>

Summary​

In this chapter, you learned:

Container Runtime: Runs containers on nodes
CRI: Standard interface for communicating with runtimes
Runtimes: containerd, CRI-O (recommended), Docker (deprecated)
Isolation: Linux namespaces and cgroups
Images: Downloaded from registries

Next Steps​

Now that you understand the Container Runtime:

Chapter 2.9: Inter-Component Communication
Chapter 2.10: Add-ons and Extensions

Chapter created: December 2024