cri
is a containerd plugin implementation of Kubernetes container runtime interface (CRI).
With it, you could run Kubernetes using containerd as the container runtime.
cri
is a native plugin of containerd 1.1 and above. It is built into containerd and enabled by default.
cri
is in GA:
See test dashboard
CRI-Containerd Version | Containerd Version | Kubernetes Version | CRI Version |
---|---|---|---|
v1.0.0-alpha.x | 1.7, 1.8 | v1alpha1 | |
v1.0.0-beta.x | 1.9 | v1alpha1 | |
End-Of-Life | v1.1 | 1.10+ | v1alpha2 |
HEAD | 1.10+ | v1alpha2 |
For a production quality cluster on GCE brought up with kube-up.sh
refer here.
For a multi node cluster installer and bring up steps using ansible and kubeadm refer here.
For non ansible users, you can download the cri-containerd
release tarball and deploy kubernetes cluster using kubeadm as described here.
The current release of the cri
plugin has the following dependencies:
See versions of these dependencies cri
is tested with.
As containerd and runc move to their respective general availability releases, we will do our best to rebase/retest cri
with these releases on a weekly/monthly basis. Similarly, given that cri
uses the Open Container Initiative (OCI) image and runtime specifications, we will also do our best to update cri
to the latest releases of these specifications as appropriate.
cri
and runc seccomp support. libseccomp-dev
(Ubuntu, Debian) / libseccomp-devel
(Fedora, CentOS, RHEL). On releases of Ubuntu <=Trusty and Debian <=jessie a backport version of libseccomp-dev
is required. See travis.yml for an example on trusty.btrfs-tools
(Ubuntu, Debian) / btrfs-progs-devel
(Fedora, CentOS, RHEL)socat
(required by portforward).cri/
project directory:# Note: install.deps installs the above mentioned runc, containerd, and CNI # binary dependencies. install.deps is only provided for general use and ease of # testing. To customize `runc` and `containerd` build tags and/or to configure # `cni`, please follow instructions in their documents. make install.deps
cri
To build and install a version of containerd with the cri
plugin, enter the following commands from your cri
project directory:
make
sudo make install
NOTE: The version of containerd built and installed from the Makefile
is only for testing purposes. The version tag carries the suffix “-TEST”.
cri
supports optional build tags for compiling support of various features. To add build tags to the make option the BUILD_TAGS
variable must be set.
make BUILD_TAGS='seccomp apparmor'
Build Tag | Feature | Dependency |
---|---|---|
seccomp | syscall filtering | libseccomp development library |
selinux | selinux process and mount labeling | |
apparmor | apparmor profile support |
cri
SetupA Kubernetes incubator project called cri-tools includes programs for exercising CRI implementations such as the cri
plugin. More importantly, cri-tools includes the program critest
which is used for running CRI Validation Testing.
Run the CRI Validation test to validate your installation of containerd
with cri
built in:
make test-cri
If you already have a working development environment for supported Kubernetes version, you can try cri
in a local cluster:
containerd
with cri
plugin that you built and installed above as root in a first terminal:sudo containerd
containerd
:CONTAINER_RUNTIME=remote CONTAINER_RUNTIME_ENDPOINT='unix:///run/containerd/containerd.sock' ./hack/local-up-cluster.sh
See here for information about test.
See here for information about using crictl
to debug pods, containers, and images.
See here for information about how to configure cri plugins and here for information about how to configure containerd
See here for additional documentation.
Interested in contributing? Check out the documentation.
This project was originally established in April of 2017 in the Kubernetes Incubator program. After reaching the Beta stage, In January of 2018, the project was merged into containerd.
For async communication and long running discussions please use issues and pull requests on this github repo. This will be the best place to discuss design and implementation.
For sync communication we have a community slack with a #containerd channel that everyone is welcome to join and chat about development.
Slack: https://dockr.ly/community
As this project is tightly coupled to CRI and CRI-Tools and they are Kubernetes projects, some of our project communications take place in the Kubernetes' SIG: sig-node.
For more information about sig-node
, CRI
, and the CRI-Tools
projects:
#sig-node
channel in Kubernetes (kubernetes.slack.com)If you are reporting a security issue, please reach out discreetly at security@containerd.io.
The containerd codebase is released under the Apache 2.0 license. The README.md file, and files in the “docs” folder are licensed under the Creative Commons Attribution 4.0 International License under the terms and conditions set forth in the file “LICENSE.docs”. You may obtain a duplicate copy of the same license, titled CC-BY-4.0, at http://creativecommons.org/licenses/by/4.0/.
This project follows the CNCF Code of Conduct.