Keyboard shortcuts

/ or ⌘/Ctrl K
Find a note
j / k
Next / previous section or linked note
h / l
Collapse or go to parent / expand or enter
e or Alt-click
Read a linked note here
o
Open focused note on its own
g g / G
First / last section or linked note
g h / g a
Home / all notes
g b / g t
Backlinks / table of contents
t
Cycle System, Light, Dark
? / Esc
Show / close this reference

Search: ↑/↓ or Ctrl N/P, Enter to open. Shortcuts pause while typing.

containerd [f2a68fd0]

Tags: kubernetes (k8s)

  • "Container runtime"
  • below docker and kube
  • above runc, Kata, Firecracker, gVisor
  • Extensible resource manager
  • originally built up alongisde docker
  • new interface for managing containers and images
  • most memory efficient and stable
  • most stuff flows through the core
  • communicates with grpc

1. CRI

  • Two grpc services
  • image and runtime
  • responsible for defining the pod and all cgroups
  • invokes CNI after the first container is created

2. Resource management

  • current

    • CPU manager in kubelet
    • strange, difficult to use

  • NRI

    • kubelet abstraction is too blurry
    • hook into container lifecycle is the correct way
    • dynamic topology and cpu pinning with NRI

3. Runtime

  • Starts up new runtime shims

    • OCI runtime shims

      • runc/kata/Firecracker

4. Plugin System

  • OCI spec outlines how to run a unpacked filesystem bundle

    • tar/gzip + overlayFS + runC
  • containerd makes external plugins as backend

4.1. Generic image layer support

  • OCI image layer described the media type

4.2. ShimV2 for runtime implementation

  • First class shim API

5. Arch

  • Shim has the most state
  • API and client have the least state
  • 1.4 is the most recent release