Kubernetes is a container orchestrator platform, not the docker platform. It means we can switch to a different container solutions in the Kubernetes environment and the key point is the CRI, container runtime intface. We will talked about what is the CRI and how to use it in the Kubernetes world, we also introduce what is the OCI, the basic concept of the OCI, inclduing Runtime spec and Image spec.

1. Introduction to CRI and OCI
HungWei Chiu

2. HungWei Chiu(Hwchiu)
MTS @ Open Networking Foundation (ONF)
Kubernetes/Container/Linux/Network...etc
Online courses in Hiskio platform
Blog: https://hwchiu.com

3. Users Groups
CNTUG (Cloud Native Taiwan User Group)
Facebook: https://fb.cloudnative.tw
Telegram: https://t.me/cntug
Meetup: https://www.meetup.com/CloudNative-Taiwan/

4. Agenda
Introduction to OCI
Introduction to CRI
Discussion
CRIO/Containerd/Docker

5. Open Container Initiative
Established in June 2015 by Docker and other leaders in the container industry.
The OCI currently contains two speci
fi
cations
Runtime speci
fi
cation
Image speci
fi
cation
OCI would download an OCI image then unpack that image into an OCI Runtime
fi
lesystem bundle.
The OCI Runtime Bundle would be run by an OCI Runtime.

6. Workfl ow
Image (spec)
Con
fi
g layers
Bundle Container Process
Runtime Con
fi
g Roots
Image Spec Runtime Spec
unpack create
delete
An OCI image will be downloaded from somewhere (Docker hub) and then
it will be unpacked into an OCI Runtime
fi
lesystem bundle.
OCI Runtime Bundle will be run by an OCI Runtime, The Runtime
Speci
fi
cation de
fi
nes how to run a "
fi
lesystem bundle"

7. Image Speci
fi
cation
De
fi
nes the archive format of OCI container images
Consist of a manifest, an image index, a set of
fi
lesystem
layers and a con
fi
guration.
Enable the creation of interoperable tools for building,
transporting, and preparing a container image to run.

8. https://medium.com/@Alibaba_Cloud/open-container-initiative-oci-speci
fi
cations-375b96658f55
Image Layout
index.json manifest Con
fi
g
Layers [Base, upper layer 1,2,3..]
Lists
Con
fi
g
Con
fi
guration of the image, will be converted to the runtime con
fi
gure
fi
le of the runtime bundle
Layers, which makes up the root
fi
le system.
Layers
Makes up the
fi
nal rootfs, the
fi
rst layer is the base.

9. Runtime Speci
fi
cation
Speci
fi
es the con
fi
guration, execution environment, and lifecycle of a container.
Con
fi
guration
Metadata necessary to implement standard operations against the container.
Includes the process to run, environment variables.
Lifecycle
create/prestart/createRuntime/createContainer/poststart/delete/poststop

10. Container Lifecycle
created started
stoppeddeleted
prestart hook
prestart hook
poststart hook
StartCreate
Stop
Delete

11. Image, Container and Processes
created started
stoppeddeleted
prestart hook
prestart hook
poststart hook
StartCreate
Stop
Delete
Runtime
Bundle

12. OCI Implementation
Runtime (Container)
opencontainers/runc
projectatomic/bwrap-oci
containers/crun
alibaba/inclavare-containers
Runtime (Virtual Machine)
hyperhq/runv
clearcontainers/runtime
google/gvisor
kata-containers/runtime

13. How Docker Works
OCI/runtime-spec
runc
libcontainer
containerd
dockerd
docker
Use
Use
UseImplemente
Import
Donate
docker Inc

14. Containers
Docker
Podman
Rkt
Contianerd
Cri-o
Singularity
Frakti
....

15. CRI
Contianer Runtime Interface
Pod and container lifecycle management
https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/
kubelet CRI shim Container
Runtime Container
grpc
client
grpc
server
CRI protobuf

16. How Kubernetes Works(v1)
OCI/runtime-spec
runc
libcontainer
containerd
dockerd
docker
Use
Use
UseImplemente
Import
Donate
docker Inc
kubelet docker-shim
CRI
Container Runtime Interface

17. How Kubernetes Works(v2)
OCI/runtime-spec
runc
libcontainer
containerd
dockerd
docker
Use
Use
UseImplemente
Import
Donate
docker Inc
kubelet CRI-Containerd
CRI
Container Runtime Interface

18. How Kubernetes Works(v3)
OCI/runtime-spec
runc
libcontainer
containerd
dockerd
docker
Use
Use
UseImplemente
Import
Donate
docker Inc
kubelet
CRI Plugin
CRI
Container Runtime Interface

19. Performance
https://kubernetes.io/blog/2018/05/24/kubernetes-containerd-integration-goes-ga/

20. CRI-O
Lightweight container runtime for kubernetes
Optimized for Kubernetes
Commuted to pass Kubernetes tests

21. CRI-O
https://cri-o.io/

22. How Kubernetes Works(v4)
OCI/runtime-spec runc
libcontainer
containerd
dockerd
docker
Use
Use
Use
Implemente
Import
Donate
docker Inc
kubelet
CRI Plugin
CRI
Container Runtime Interface
CRI-O
Use
Common

24. Demo
Install CRI-O, Containerd , Dockerd and Podman
Kubernetes with CRI-O
Operate by CLI tools
crictl (CLI for CRI shim)
ctr (CLR for contaienrd)
podman

25. Demo Environment
runcpodman
kubelet
docker
ctr
crictl
cri-o
Dockerd
Containerd

26. Demo 0
Use the CRICTL to check Kubernetes pods and containers.

27. Demo 1
Use Docker to pull image and create a container.
Use the CTR to check the status of containerd

28. Demo 2
Use CTR to pull image and create a container.
Use the CTR to check the status of containerd

29. Demo 3
Use kubectl to deploy a container
Use the CRICTL to check status

30. Demo 4
Use the CRICTL to pull image and run a container
Change the endpoint from CRI-O to Containerd.
Use the CTR to check the status of Containerd.

31. Demo 5
Use the podman to pull image and run container.
Check the process information from `ps`

33. Helm3 --> OCI Image format
Harbor -> OCI Image
Container Image
Helm v3
EXPERIENCE_OCI=1

34. Reference
https://github.com/opencontainers/runtime-spec
https://medium.com/@Alibaba_Cloud/open-container-
initiative-oci-speci
fi
cations-375b96658f55