“Docker” is often used loosely to mean “containers,” but underneath, several distinct container runtimes actually do the low-level work — worth knowing the difference, especially when working with Kubernetes.
The Layers
- runc — the low-level runtime that actually creates and runs a container using Linux namespaces and cgroups; implements the OCI runtime spec
- containerd — a higher-level daemon managing the container lifecycle (image pulls, storage, networking), using runc underneath to actually execute containers
- CRI-O — built specifically for Kubernetes, implementing the Container Runtime Interface directly, lighter-weight than running full Docker just to satisfy Kubernetes’ runtime requirement
# Modern Docker itself is layered on containerd underneath docker info | grep -i runtime # Kubernetes nodes commonly run containerd or CRI-O directly, # without the full Docker Engine on top at all crictl info # CRI-compatible inspection tool
Why This Layering Exists
Kubernetes deprecated direct “Docker” support (dockershim) in favor of any runtime implementing the standard Container Runtime Interface — this is exactly why a Kubernetes node doesn’t need Docker installed at all, just a CRI-compliant runtime like containerd or CRI-O, which are lighter and more purpose-built for that specific job.