This guide walks Kubernetes operators through a systematic, step‑by‑step process for diagnosing nodes stuck in the NotReady state, covering kubelet status reporting, common failure reasons, detailed command‑line checks, root‑cause analysis, remediation steps, verification, and long‑term preventive measures.
This article provides a comprehensive analysis of containerd and CRI‑O as Kubernetes container runtimes, covering their architectures, feature sets, installation procedures, migration strategies, performance benchmarks, best‑practice configurations, troubleshooting tips, and monitoring approaches to help operators decide which runtime best fits a production environment.
Apple Container is an open‑source Swift CLI that runs Linux containers on Apple‑Silicon Macs via per‑container lightweight VMs, offering OCI compatibility, faster startup, better memory use, native networking, and strong isolation compared with Docker Desktop, while detailing system requirements, installation steps, and macOS 15 limitations.
This article examines why many Kubernetes failures stem from the container runtime layer, explains the responsibilities of Docker, containerd, runc, and CRI, and provides production‑grade architectures, tuning guidelines, migration steps, security hardening, and observability practices to keep clusters stable and performant.
This article compiles the ten most frequent Docker problems encountered in production—such as disk exhaustion, time drift, DNS failures, OOM kills, data loss, tag confusion, signal handling, resource‑limit oversights, and exposed daemon ports—provides concrete symptoms, root‑cause explanations, diagnostic commands, remediation steps, and preventive measures, and also lists five often‑overlooked traps.
The article explains how OpenAI extends the Responses API with a sandboxed computer environment—shell tools, container workspaces, network controls, context compression, and reusable skills—to let language models execute complex, stateful workflows safely and efficiently.
This article provides a comprehensive overview of the core container technologies—Docker, containerd, runc, and Kubernetes—explaining their evolution, relationships, component roles, runtime layers, security options, and practical recommendations for choosing the right runtime in development and production environments.
This step‑by‑step guide shows how startups can replace Docker with Podman, covering installation on Linux, macOS and Windows, aliasing Docker commands, running existing containers, converting Dockerfiles, building and pushing images, leveraging root‑less security, handling common pitfalls, and automating CI/CD pipelines.
This article provides a comprehensive overview of Docker, explaining its lightweight container model, client‑server architecture, key Linux kernel features such as namespaces and cgroups, image layering, networking, and the three‑stage process of building, distributing, and running containers.
This article explains what Podman is, highlights its key differences from Docker—including daemon‑less and rootless operation—covers installation, configuration, common commands, image handling, volume management, and how to set up registry accelerators for efficient container workflows.
This article explains what Podman is, highlights its key architectural differences from Docker, and provides step‑by‑step instructions for installing, configuring, and using Podman—including common commands, image handling, rootless operation, volume management, and integration tips for Linux environments.
Kubernetes 1.33 introduces in‑place vertical pod resizing, allowing administrators to adjust CPU and memory resources on running containers without restarting pods, reducing downtime for stateful workloads, improving cost efficiency, and integrating with VPA, while outlining implementation details, supported runtimes, limitations, and practical demos.
The article examines Docker's diminishing dominance, outlines its historical impact and current limitations, and explores lighter alternatives, modern runtimes, and evolving orchestration solutions that together shape the next generation of containerized development and deployment.
This article explains what Podman is, highlights its daemon‑less and rootless architecture compared to Docker, lists essential commands, shows installation and configuration steps, and provides practical tips for using Podman in Linux environments.
This article explains what Podman is, compares its daemon‑less, rootless architecture to Docker's daemon‑based model, and provides step‑by‑step installation, configuration, and command‑line examples for managing containers, images, volumes, and networking on Linux.
This article explains what containerd is, why it is needed, its technical goals and architecture, provides step‑by‑step installation on Ubuntu, shows how to configure it as a system service, and demonstrates a complete Go program that creates, runs, and cleans up a Redis container using the containerd client library.
SpinKube combines Spin Operator, containerd‑shim‑spin, and an upcoming runtime‑class‑manager to deliver a lightweight, fast‑starting WebAssembly runtime on Kubernetes that addresses the dependency, resource, and image‑size challenges of traditional container‑based serverless architectures.
This article explains how Kubernetes, through the Kubelet and CRI components such as containerd and cri‑o, pulls container images, stores them on the node, and performs periodic garbage collection based on configurable age and disk‑usage thresholds.
This article explains Kubernetes container runtimes, the CRI and OCI standards, compares Docker, containerd, CRI‑O and runc, outlines the challenges of log collection in K8s, and shows how open‑source collectors like Filebeat and Fluent Bit as well as iLogtail's daemonset and sidecar modes provide flexible, enriched logging solutions.
When a new Pod is created, Kubelet coordinates with the CRI and CNI components to set up the sandbox, configure networking, pull images, create and start containers, using gRPC calls and command‑line interactions, with details varying across container runtimes such as containerd, cri‑o, and Docker.
This article explains the history and evolution of Docker and Containerd, compares their architectures and functions, and discusses how Containerd operates independently within cloud‑native environments such as Kubernetes.
The article explains the mGPU solution from Volcano Engine, detailing its kernel‑level GPU virtualization, container runtime hooks, and scheduling mechanisms that allow multiple containers to share a single NVIDIA GPU with isolated compute and memory resources, achieving near‑lossless performance and up to 50% higher utilization for AI tasks.
This guide walks you through initializing a new Kubernetes node, installing a container runtime (containerd or Docker with cri‑dockerd), configuring kernel parameters, deploying the Calico CNI plugin, and verifying the node and network components in a production‑grade cluster.
This article explains containerd’s role in Docker, outlines its core responsibilities and design goals, shows how to install and configure it on Ubuntu, and provides a complete Go example that pulls a Redis image, creates a container, runs and cleans up the task.
This article introduces the concept of managed Kubernetes clusters, compares them with traditional setups, details the architecture and implementation process, discusses challenges such as cross‑cluster webhook routing, certificate issuance, container runtime integration, and outlines the diverse features of the dedicated cluster solution.
This article explains the role of container runtimes, distinguishes low‑level, high‑level, and sandbox runtimes, and compares three major implementations—containerd, CRI‑O, and Docker—detailing their architecture, image handling, networking, storage, and integration with OCI specifications.
Podman, a daemonless OCI‑compatible container engine created by Red Hat, offers rootless operation, tighter security, and direct runtime interaction, positioning it as a compelling alternative to Docker while its broader adoption depends on ecosystem maturity and community support.
This article provides a comprehensive overview of Kubernetes core components, such as Master and Worker nodes, and explains the purpose and usage of various plugins—including network, volume, ingress, DNS, dashboard, heapster, kubelet, and container runtime—along with practical command‑line examples for each.
When replacing dockershim with containerd, we observed that pods take over a minute to start because the GenericPLEG Relisting operation stalls for more than 30 seconds during node boot, caused by containerd’s UpdateContainerResources holding a bbolt lock and intensive image pulls; the article explains the root cause and provides a fix using the overlay volatile mount option.
This article explains the role of container runtimes, classifies them into low‑level, high‑level, and sandbox types, and details the architectures and key components of popular runtimes such as containerd, CRI‑O, and Docker, highlighting their interactions with OCI specifications and system resources.
Container runtimes are essential for managing containers in Kubernetes, and this article explains their core functions, compares Docker and containerd, details the CRI interface, explores supported backends, and provides practical command references to help you choose the optimal runtime for cloud‑native deployments.
This article explains how Kubernetes ensures each Pod receives a unique IP address by detailing the roles of the network provider, CNI plugins, CRI, and container runtimes such as containerd, with a focus on Flannel's vxlan and bridge implementations.
This guide explains what Podman is, how it differs from Docker, and provides step‑by‑step instructions for installing, configuring, and using Podman—including common commands, rootless operation, registry accelerators, volume handling, and essential configuration files—so you can manage containers without a daemon.
This article introduces Podman, an open‑source, daemon‑less container runtime compatible with Docker, explains its architectural differences, rootless operation, configuration files, common commands, image handling, volume usage, and practical tips for Linux environments.
This article explains how Kubernetes ensures each Pod gets a unique IP address by detailing the roles and interactions of Flannel, CNI plugins, the CRI, and the kube‑controller‑manager, and shows the configuration steps needed for container runtimes like containerd.
This article introduces Huawei Cloud's open‑source Kuasar multi‑sandbox container runtime, explains sandbox container types, outlines Kuasar's architecture and benefits, and presents performance benchmarks and quick installation steps for developers seeking secure and efficient cloud‑native workloads.
This article explains how Kubernetes networking components—including Linux Bridge, Flannel's VXLAN, the node IPAM controller, kubelet, container runtimes, and CNI plugins—work together to give every pod a unique IP address and enable inter‑pod communication across nodes.
This article explains the core components of Kubernetes architecture—including the control plane (etcd, API server, controller manager, scheduler) and worker node components (kubelet, kube-proxy, container runtimes)—detailing their roles, interactions, and best‑practice considerations for maintaining healthy, scalable clusters.
This article explains how containerd works as a high‑level container runtime and demonstrates practical usage of its three command‑line clients—ctr, nerdctl, and crictl—for pulling images, managing containers, debugging Kubernetes pods, and performing low‑level runtime operations.
By profiling the OCI runtime with hyperfine and applying a series of kernel patches, seccomp hash optimizations, and BPF compilation caching, the author reduced container start‑up time from roughly 160 ms in 2017 to just over 5 ms today—a near 30‑fold speedup.
This guide explains what containerd is, how to manage images and containers with its command‑line clients ctr, nerdctl, and crictl, and provides practical examples of pulling, running, inspecting, and cleaning up containers in a Linux environment.
This guide explains the advantages of cgroup v2 over v1, outlines the Linux distribution and kernel requirements, and provides detailed, command‑line instructions for enabling cgroup v2 on Debian, configuring kubelet and containerd, and updating monitoring tools for Kubernetes clusters.
Kubernetes 1.26, themed “Electrifying,” introduces 37 enhancements—including registry changes, storage upgrades, signed release artifacts, Windows high‑privilege containers, metric and scheduling improvements—while promoting 11 features to stable, deprecating 12 APIs, and emphasizing sustainability and carbon‑footprint awareness.
While Docker remains popular, a growing ecosystem of container runtimes—such as Podman, LXD, containerd, Buildah, BuildKit, and Kaniko—offers distinct features, security models, and integration options that make them viable replacements for various development and deployment scenarios.
Docker announced a technical preview of WebAssembly support that swaps its runC runtime for WasmEdge, promising faster startup and smaller binaries, while investors pour money into Wasm PaaS platforms and the ecosystem expands through initiatives like the Bytecode Alliance.
This article examines seven Docker alternatives—Podman, LXD, containerd, Buildah, BuildKit, Kaniko, and RunC—detailing their architectures, key differences, security features, and use‑cases to help DevOps teams choose the right container runtime for their workloads.
This guide explains how to switch a Kubernetes cluster’s container runtime from Docker to containerd, including node maintenance, configuration changes, restarting services, verifying the runtime, installing and using crictl for container management, and comparing CLI tools, with detailed command examples.
Kubernetes 1.25 officially ships cgroup v2 support, enabling the kubelet to leverage the latest Linux resource‑management features, and the article explains what cgroups are, the advantages of v2, how to enable it, migration considerations, and where to learn more.
This article provides a comprehensive overview of Docker's evolution, its modern architecture involving containerd, runc, and CRI, explains how containers are created and managed, and offers step‑by‑step instructions for installing, configuring, and operating containerd with the ctr command‑line tool on Linux.
This guide walks you through replacing Docker with Containerd in Kubernetes, explains the crictl and ctr command‑line tools, shows how to configure Containerd, and demonstrates using nerdctl and BuildKit for image building, tagging, and pushing to Harbor.
This article explains the evolution and classification of container runtimes, detailing low‑level and high‑level implementations, demoing low‑level runtime setup with runc, and describing how Kubernetes CRI integrates with runtimes like containerd, Docker, and CRI‑O.
This guide explains why Kubernetes dropped dockershim, clarifies OCI and CRI standards, compares Docker, containerd and cri‑o runtimes, and provides a step‑by‑step procedure—including node draining, Docker removal, kernel tuning, cri‑o installation, kubelet reconfiguration, and verification—to successfully migrate a cluster from Docker to cri‑o before upgrading to version 1.24.
Kubernetes 1.24 introduces 46 enhancements—including dockershim removal, default‑disabled beta APIs, signed release artifacts, OpenAPI v3 support, storage capacity tracking, CSI volume expansion, and new priority options—while also detailing CNI version considerations, upgraded runtimes, and how to access the release notes and tutorials.
Kubernetes 1.24, released in early 2022, introduces 46 enhancements—including the removal of dockershim, default‑off test APIs, signed release artifacts, OpenAPI v3 support, GA storage capacity tracking and volume expansion, new CNI requirements, and numerous API graduations—while also deprecating or deleting several legacy components.
This article provides a comprehensive overview of Podman, an open‑source, daemon‑less container runtime, compares it with Docker, explains key architectural differences, and offers detailed instructions on installation, configuration, common commands, rootless usage, volume handling, and migration aliases.
This article explores the maturation of cloud computing, explains why cloud‑native has become the driving engine for modern workloads, and provides a detailed overview of Kubernetes architecture, its extensibility, and the fragmentation challenges across runtimes, networking, storage, and application management.
This article explains the key components and standards of the container ecosystem—including Docker, containerd, CRI‑O, OCI and runc—detailing how they interact, the role of the Container Runtime Interface, and why Docker is only a small part of a broader, interoperable cloud‑native landscape.
This article explains how OpenKruise, a CNCF sandbox project, overcomes native Kubernetes container‑runtime limitations by integrating with Kubelet and CRI, offering features such as in‑place upgrades, container restarts, image pre‑heating, and a modular architecture that enhances workload management and runtime control.
This article explains what Podman is, highlights its key architectural differences from Docker, provides Docker‑compatible command references, shows how to install and configure accelerators, demonstrates rootless operation, and covers essential configuration files and volume handling for secure container management on Linux.
According to CNCF’s 2021 Cloud‑Native Survey, 96% of organizations are using or evaluating Kubernetes, marking its transition to mainstream, with rapid growth in developer adoption, container runtimes, and related projects, while highlighting emerging trends in edge, observability, and security for 2022.
This article explains the relationship between kubelet, Docker, containerd, and runc, walks through a real‑world exec failure logged by dockerd, and shows how to pinpoint the faulty component, identify resource‑limit causes, and understand runc’s execution workflow.
Explore seven robust Docker alternatives—including Podman, LXD, containerd, Buildah, BuildKit, Kaniko, and RunC—detailing their unique features, security benefits, and use‑case scenarios, so you can choose the right container engine for your development and deployment workflows.
This article provides a comprehensive overview of Podman, an open‑source, daemon‑less container runtime, comparing it with Docker, detailing its architecture, installation, configuration, common commands, image building, registry acceleration, user namespace setup, volume handling, and rootless port mapping for Linux systems.
This article introduces Podman, an open‑source container runtime that runs without a daemon or root privileges, compares its architecture and features with Docker, and provides detailed instructions for installation, configuration, common commands, image management, volume handling, and user‑namespace setups on Linux.
This article provides a comprehensive overview of Podman, explaining its architecture, key differences from Docker, common commands, installation steps, configuration details, and practical usage examples for managing containers, images, volumes, and rootless operation on Linux systems.
This article introduces containerd, compares its features, architecture, data directories, logging, CNI integration, stream services, commands, and namespaces with Docker, and helps you decide which container runtime best fits your Kubernetes deployments.
RunC, the OCI‑compliant low‑level container runtime originally derived from Docker’s libcontainer, works alongside high‑level runtimes like containerd and cri‑o, and this article explains its origins, lifecycle states, usage commands, and how it fits into the broader cloud‑native container ecosystem.
This guide explains how runc implements the OCI runtime spec, walks through creating an OCI bundle, using skopeo and umoci to fetch images, and demonstrates running containers in foreground and detached modes while highlighting the underlying Linux namespace mechanics.
The article examines Docker’s evolution from a pioneering container platform to its current struggles, highlighting how funding pressures, strategic missteps, a contentious relationship with Kubernetes, and leadership conflicts led to missed commercial opportunities and a precarious future for the company.
This article provides a detailed analysis of the kubelet CRI pod creation workflow, using the dockershim implementation as an example, and includes step‑by‑step code walkthroughs of SyncPod, sandbox creation, and the interactions between kubelet, CRI shim, Docker, and CNI.
The article explains the history of containers, the role of Docker and Kubernetes, why Kubernetes is deprecating Docker's dockershim, the timeline for the change, its impact on users, and the steps required to migrate to OCI‑compatible runtimes such as containerd or CRI‑O.
This article provides a detailed overview of Docker’s evolution, the role of containerd, runc, and CRI in modern container runtimes, explains how Docker delegates container lifecycle management to containerd‑shim, and offers step‑by‑step instructions for installing, configuring, and using containerd with its CLI tools on Linux.
This article explains the evolution and inner workings of Kubernetes container runtimes, detailing the roles of CRI, OCI, Docker, containerd, CRI‑O, and strong‑isolation solutions like Kata, gVisor, and Firecracker, and why the default dockershim remains prevalent.
This guide walks through downloading the Docker 20.10.7 offline package, extracting it on a CentOS 7 host, configuring a systemd service, starting Docker, verifying the installation, and then fully removing Docker and its service files when needed.
This article explains the background of containers, compares Docker and Kubernetes, details the deprecation of Docker's dockershim in Kubernetes v1.20, outlines the impact on developers and operators, and provides practical steps for migrating to OCI‑compatible runtimes.
The article explains the background of containers, the role of Docker as a runtime, why Kubernetes is deprecating Docker in favor of CRI‑compatible runtimes, the migration path, and what developers and cluster operators need to know to adapt to the change.
This article explains why Docker containers often stop right after starting, covering the role of PID 1, daemon‑off mode, Linux process management concepts like zombie and orphan processes, and how Docker’s containerd‑shim and runC interact to keep containers alive.
This article explains what containerd is, compares it with Docker, describes Kubernetes' CRI support, and provides step‑by‑step commands for using containerd via crictl, showing that migrating from Docker to containerd is simple and resource‑efficient.
This article explains the evolution and inner workings of Kubernetes container runtimes, covering the classic Docker‑based flow, the roles of CRI, OCI, containerd, CRI‑O, and strong‑isolation solutions like Kata, gVisor, and Firecracker, while clarifying why the architecture became so layered.
The article examines why Docker is no longer the sole container solution, compares alternative container engines like Podman, LXD, and CRI‑O, reviews image‑building tools such as Buildah, Kaniko and BuildKit, and outlines runtime and inspection utilities including runc, crun, containerd, Skopeo and Dive.
Explore the evolution of Containerd from Docker’s early days, its architecture, installation on Ubuntu, configuration nuances, performance benchmarks, and practical usage with the ctr CLI, while also learning how it integrates with Kubernetes, Docker, and tools like Sealos for streamlined container management.
Kubernetes has officially deprecated Docker support by removing the dockershim bridge, explaining that Docker lacks native CRI compliance, and recommends migrating to CRI‑compatible runtimes such as containerd or CRI‑O while clarifying the differences between CRI and OCI runtimes.
Kubernetes 1.20 marks the deprecation of Docker support, explaining that Docker’s heavyweight nature and the maintenance burden of the dockershim layer drove the change, while reassuring developers that OCI‑compatible images still run unchanged, though operators must switch to containerd or CRI‑O.
Starting with version 1.20 Kubernetes deprecates Docker as a container runtime, but Docker images remain usable through CRI‑compatible runtimes like containerd or CRI‑O, so developers can keep building with Docker while clusters transition to supported runtimes with minimal disruption.
While Docker once dominated containerization, a growing ecosystem of specialized tools—such as Podman, Buildah, Kaniko, BuildKit, and various runtimes—offers more focused, daemon‑less, and OCI‑compatible alternatives for building, running, and distributing images, prompting developers to evaluate which combination best fits their workflows.
The article examines how open‑source projects can achieve robust security through organized vulnerability management teams, active collaboration with security researchers, and community‑driven initiatives, using Kata Containers and the broader cloud‑native ecosystem as illustrative examples.
This article explains the fundamentals of confidential computing, introduces the open‑source Inclavare Containers project and its integration with Kubernetes, details its architecture, workflow, signing models, and the related ACK‑TEE platform, and answers common questions about deployment and performance.
This article analyzes Docker's declining market share and provides a detailed comparison of alternative container runtimes—including rkt, Mesos, LXC, OpenVZ, and Containerd—highlighting their features, advantages, and limitations for various production scenarios.
This article explains the evolution of container runtimes, the introduction of the Container Runtime Interface, and how Kubernetes RuntimeClass—introduced in v1.12 and expanded in later versions—enables multiple runtimes, custom scheduling, and pod overhead accounting, with practical YAML examples and multi‑runtime deployment scenarios.
This article explains the origins and design of Kubernetes' Container Runtime Interface (CRI), how it abstracts container runtimes, details its lifecycle and streaming operations, reviews major implementations like CRI‑containerd and CRI‑O, and introduces essential debugging tools.
OpenEuler, Huawei's newly open‑sourced Linux distribution, offers a unified, multi‑architecture OS with container support, AI‑driven optimization projects, and a massive package ecosystem, positioning it as a key player for enterprise cloud‑native environments.
This article examines how Mirantis’ acquisition of Docker, the historical contributions of major vendors, and the development of container runtimes such as LXC, runc, CRI‑O, and containerd have shaped the modern cloud‑native ecosystem and OpenShift’s architecture.
This guide explains how to replace Docker with Podman for hosting a static Hugo site, using a sidecar Envoy proxy, shared network namespaces, Kubernetes‑compatible pod definitions, and systemd services to achieve automatic startup and reliable service discovery.
This article explains the core concepts of container technology—including specifications, runtimes, management tools, image definitions, registries, and container operating systems—while illustrating why containers are advantageous for developers and operations teams in modern software delivery.
This article explores the evolution and architecture of Kubernetes container runtimes, detailing Docker, containerd, CRI‑O, OCI standards, strong‑isolation solutions like Kata, gVisor and firecracker, and their implications for security and serverless workloads.
This article explains how PouchContainer, Alibaba’s open‑source container runtime, aligns its internal and external codebases through detailed difference analysis, a plugin architecture, rigorous testing, and a disciplined Git workflow to ensure stable, extensible, and synchronized releases.
This article explains the design shortcomings of the original nvidia-docker, introduces the architecture and components of nvidia-docker 2.0—including the NVIDIA container runtime, libnvidia-container, and their integration with Docker and containerd—and details the container creation flow for both standard and GPU-enabled workloads.
Zhang Lei’s KubeCon 2018 talk explains Kubernetes’ interface‑driven design, the role of CRI, container runtimes like containerd and KataContainers, and introduces the containerd ShimV2 layer that simplifies integrating secure, VM‑based runtimes into Kubernetes without writing separate CRI shims.
This tutorial walks through installing NVIDIA‑Docker 2.0, configuring Docker’s runtime, deploying the NVIDIA device plugin on a Kubernetes 1.9 cluster, and testing GPU‑enabled pods, highlighting the advantages over the legacy nvidia‑docker 1.0 approach.
In this interview, Kubernetes contributor Lei (Harry) Zhang explains the CRI Shimv2 interface, its benefits for developers and end‑users, reflects on the 2018 container ecosystem evolution, shares highlights from KubeCon Shanghai, and discusses balancing open‑source engineering with technical evangelism.
