CRI-O
CRI-O is a lightweight container runtime purpose-built for Kubernetes. It implements the Container Runtime Interface (CRI) to pull images and run containers using OCI-compliant runtimes, without the extra tooling that general-purpose container engines include.
itCloud native tools and technologies | OpenSkills.info
Intro
CRI-O
CRI-O is a container runtime built for Kubernetes nodes. It implements the Container Runtime Interface, or CRI, that the kubelet uses to manage Pod sandboxes, containers, and images.
That narrow purpose is the key to understanding CRI-O. Kubernetes decides what should run. The kubelet turns that desired state into node-level requests. CRI-O fulfills those requests through the CRI and delegates container execution to an Open Container Initiative runtime.
Why CRI-O exists
Kubernetes needs a stable contract between the kubelet and a node's container runtime. The CRI provides that contract as a gRPC API. A runtime can implement the API without being compiled into Kubernetes.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://cri-o.io/
Supports
- CRI-O as an implementation of Kubernetes CRI for OCI-compatible runtimes
- Request path from Kubernetes and kubelet through CRI-O to an OCI runtime
- Use of containers image and storage libraries
- conmon monitoring and logging role
- CNI delegation for Pod networking
- Current distribution packaging entry points
- https://github.com/cri-o/cri-o
Supports
- CRI-O project scope and explicit exclusions
- Container image, process lifecycle, monitoring, logging, and isolation responsibilities
- Kubernetes and CRI-O minor release alignment with independent patch schedules
- Configuration areas for CRI-O, registries, image policy, and storage
- crictl as a client for CRI-compatible runtimes
- Runtime, metrics, tracing, and debugging documentation entry points
- https://kubernetes.io/docs/concepts/containers/cri/
Supports
- CRI as the kubelet-to-runtime plugin interface and gRPC protocol
- Kubelet role as CRI client
- Separate runtime and image service endpoints
- CRI version 1 requirement for Kubernetes from version 1.26
- https://kubernetes.io/docs/setup/production-environment/container-runtimes/
Supports
- Requirement for a container runtime on every node
- Need for aligned kubelet and runtime cgroup drivers
- systemd cgroup-driver guidance on systemd hosts
- CRI-O default systemd cgroup driver
- Default CRI-O socket path
- CRI-O pause-image configuration and live reload behavior
- Runtime setup as separate from network-plugin setup
- https://github.com/kubernetes-sigs/cri-tools/blob/master/docs/crictl.md
Supports
- crictl use of the CRI API
- Runtime, sandbox, container, image, log, inspect, and filesystem commands
- Explicit runtime-endpoint configuration
- https://cri-o.github.io/cri-o/
Supports
- Official CRI-O release history organized by version