CRI-O

Free plan APILinuxSelf-hosted

What CRI-O is

CRI-O is a Linux container runtime that connects Kubernetes to OCI containers through the Kubernetes Container Runtime Interface. It lets Kubernetes launch and manage containers, using OCI-compatible runtimes such as runc and Kata Containers. CRI-O can pull OCI container images from any container registry, while building, signing, and pushing images to storage sit outside its project scope.

For container storage, it supports OverlayFS, devicemapper, AUFS, and btrfs, with OverlayFS selected by default. Pod networking uses CNI; named tested plugins include Flannel, Weave, and OpenShift-SDN. The conmon utility monitors containers, manages logging and attach clients, and detects out-of-memory situations. Security separation can use SELinux, capabilities, seccomp, and other OCI policies.

CRI-O is community-driven open source software under the Apache-2.0 license and is a graduated Cloud Native Computing Foundation project. It follows Kubernetes release cycles and the n-2 version-skew policy for feature graduation, deprecation, or removal. Installation instructions cover RPM and DEB packages, including packages for Debian-based and Red Hat-based distributions; Fedora packaging is also available. The project directs community discussions to GitHub issues and pull requests, and chat to Kubernetes Slack.

Who it suits

CRI-O suits teams running Kubernetes on Linux that need a runtime for launching and managing OCI containers. It is also suited to deployments that need a choice of OCI-compatible runtimes, storage drivers, or CNI networking plugins.

What it does well

Implements Kubernetes CRI for managing OCI containers.
Works with runc and Kata Containers.
Pulls OCI images from any container registry.
Supports four storage drivers, with OverlayFS by default.
Uses CNI and names three tested networking plugins.
Apache-2.0 licensed community-driven open source project.

What to know first

Runs on Linux rather than a listed desktop platform.
Image building, signing, and pushing are outside its project scope.
No free trial is offered.

Limits

The free plan is available without a free trial. CRI-O does not cover building, signing, or pushing images to image storage.

Getting started

Visit the CRI-O website.
Use the Linux installation instructions for a Debian-based or Red Hat-based distribution, or the available Fedora packaging.
Install with the RPM or DEB package route described for your system.
Configure Kubernetes to use CRI-O as its container runtime.
Choose an OCI-compatible runtime and configure storage and CNI networking as needed.

Verdict

Choose CRI-O for a Linux Kubernetes environment that needs a container runtime implementing CRI and supporting OCI containers. Its runtime, storage, and CNI options suit varied cluster setups. Look elsewhere if you need image building, signing, or pushing included in the project scope.

Questions

How much does CRI-O cost?

CRI-O is free, and its pricing model is listed as a free plan. There is no free trial.

Which platforms does CRI-O support?

CRI-O runs on Linux and is listed for self-hosted use and API access. Supported host systems include Fedora, RHEL, CentOS, Debian, Raspbian, Ubuntu, openSUSE, and Flatcar Container Linux.

Is CRI-O open source, and what is its license?

Yes. CRI-O identifies itself as a community-driven open source project, and its repository lists the Apache-2.0 license.

Does CRI-O build container images?

No. Building, signing, and pushing images to image storage are outside the stated project scope.

Which runtimes and image registries can CRI-O use?

It supports OCI-compatible runtimes including runc and Kata Containers. It can pull OCI images from any container registry.

How can users get community support?

The project directs users to GitHub issues and pull requests for discussion and to the #crio channel on Kubernetes Slack for chat.

Facts from CRI-O's own pages

Image registries: CRI-O supports OCI container images and can pull images from any container registry. · cri-o.io, 7 Oct 2026
Images: CRI-O supports OCI container images and can pull images from any container registry. · cri-o.io, 7 Oct 2026
Installation: The project site provides RPM and DEB installation instructions and notes Fedora packaging is available. · cri-o.io, 7 Oct 2026
Kubernetes compatibility: CRI-O follows Kubernetes release cycles and its n-2 version-skew policy for feature graduation, deprecation, or removal. · github.com, 7 Oct 2026
License: The project repository identifies its license as Apache-2.0. · github.com, 7 Oct 2026
Linux platform: The installation guide assumes a Linux machine and describes packages for Debian-based and Red Hat-based distributions. · github.com, 7 Oct 2026
Monitoring: The conmon utility monitors containers, handles logging, serves attach clients, and detects out-of-memory situations. · cri-o.io, 7 Oct 2026
Networking: CRI-O uses CNI for pod networking, and its site names Flannel, Weave, and OpenShift-SDN as tested plugins. · cri-o.io, 7 Oct 2026
Project boundary: Building, signing, and pushing images to image storage are outside the stated scope of the CRI-O project. · github.com, 7 Oct 2026
Project status: CRI-O identifies itself as a community-driven open source project and a graduated Cloud Native Computing Foundation project. · cri-o.io, 7 Oct 2026
Purpose: CRI-O implements the Kubernetes Container Runtime Interface so Kubernetes can launch and manage OCI containers. · cri-o.io, 7 Oct 2026
Release artifacts: The v1.37.2 release page lists static bundles and describes SHA-256 checksums, cosign signatures, SPDX bills of materials, OpenVEX reports, and SLSA provenance artifacts. · github.com, 7 Oct 2026
Runtime support: CRI-O supports OCI-compatible runtimes, including runc and Kata Containers. · cri-o.io, 7 Oct 2026
Security: The project describes container security separation using SELinux, capabilities, seccomp, and other policies specified by OCI. · cri-o.io, 7 Oct 2026
Storage: Its storage library supports OverlayFS, devicemapper, AUFS, and btrfs, with OverlayFS as the default driver. · cri-o.io, 7 Oct 2026
Support: The project site directs users to the #crio channel on Kubernetes Slack and the project GitHub repository. · cri-o.io, 7 Oct 2026
Support and community: The project directs users to GitHub issues and pull requests for discussions and to the Kubernetes Slack channel for chat. · github.com, 7 Oct 2026
Vulnerability information: CRI-O publishes signed OpenVEX reports with releases to indicate which dependency vulnerabilities are reachable in CRI-O code paths. · github.com, 7 Oct 2026
Vulnerability reporting: Security reports are handled by community volunteers, and the project says reporters can expect an initial response within three business days. · github.com, 7 Oct 2026

Where CRI-O stands on Freedom251

Container Runtime Software#11 of 28
Container Engines#16 of 31