leelearns

Notes on container runtimes

Kubernetes is often called an orchestrator of container-based applications. But it doesn't actually run them. Sure, there is a kubectl run, but it doesn't actually create a process that gets the container running.

Well, it is kind of a strange term in this context because Kubernetes is not one thing. It's a collection of software that all work together to accomplish a goal of getting container-based applications to run on computers.

The component that actually starts container processes is called the container runtime.

containerd is the most widely-adopted one. It was originally created at Docker and is now part of the CNCF.

It does a lot. Actually, I would call it an orchestrator, too. An orchestrator of containers and even lower-level runtimes.

containerd runs on worker nodes and you can install it by downloading the binaries from github, putting them on your PATH, and wrapping it into a systemd service.

Once installed, you can pull an image:

ctr images pull docker.io/library/nginx:latest

side note: the fully-qualified image reference (including tag) is required, unlike docker pull.

But you can't actually run it:

sudo ctr run --rm docker.io/library/nginx:latest sh
ctr: failed to create shim task: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v2.task/default/sh/log.json: no such file or directory): exec: "runc": executable file not found in $PATH

This implies that containerd requires another runtime called runc

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

side note: you can call runc an "OCI runtime" -- OCI is the Open Container Initiative, which is an organization that creates and maintains container standards and specifications, and most container-related tooling build with OCI-compatibility as a requirement.

You can download the binary from github. Once it's installed you get closer to running a container.

But something else is missing... a CNI plugin needs to be installed

A CNI plugin is what handles the networking interfaces in containers: creating network namespaces, configuring IP addresses and establishing connectivity between the containers and the host machine.

You can download and install some CNI plugins from containernetworking. Here's an example of a bridge plugin

Once runc and the CNI plugins are installed, you can run a container.

To summarize: