Thread by @iximiuz

Kubernetes is deprecating Docker as a container runtime after v1.20. But nobody cares. Why? Because images built with Docker will keep working on Kubernetes.

So does images created with Podman and most of the other build tools around. Why? Because of the great standardization effort called OCI!

opencontainers.org

OCI contains two specifications: the Runtime Specification (runtime-spec) and the Image Specification (image-spec).

But there is no such thing as Container Specification! I.e no one tells you what a standard container should look like. Only what a tool running containers should look like - the runtime.

There is a dominating OCI-compliant container runtime called runc. It used to be a part of Docker, but it's a standalone tool and project now. Containers created via runc are based on Linux namespaces and cgroups.

There is an alternative but similar runtime called crun. Same thing, but written in C.

However, there is also a gVisor project with a tool called runsc which also an OCI-compliant runtime. And a user-space Linux kernel implementation at the same time! Mind-blowing.

But there is more! Kata containers project offers an OCI-compliant runtime that is Hypervisor-based! I.e Kata containers are rather traditional (well, probably more lightweight) virtual machines!

By the way, the main difference between containers and VMs was supposed to be a virtualization layer. VMs provide hardware virtualization. Containers - operating system virtualization. But Kata containers are VMs. Wait, what?! 🤯

Getting back to the benefits of standardization. Kubernetes defines its own standard of container runtime - Container Runtime Interface (CRI). It's more high-level thingy than OCI runtime-spec. It also introduces the concept of Pod.

github.com/kubernetes/cri…

Kubelet (a Kubernetes node agent) can work with any CRI-compliant runtime. Containerd - is a CRI-compliant runtime. CRI-O is a CRI-compliant runtime. Docker is not. At least for now.

Both Containerd and CRI-O (theoretically) can operate any OCI-compliant runtime under the hood. Hence, kubelet -> CRI-O -> Kata runtime is a totally viable setup making VM-based Pods a reality. Standardization rules!

Well-known OCI-runtime implementations:

github.com/opencontainers…

Well-known Linux containers implementations:

en.wikipedia.org/wiki/List_of_L…