A container runtime is the software on each Kubernetes node that runs containers for Pods. It matters because the kubelet relies on the runtime’s Container Runtime Interface (CRI), and runtime-specific settings affect node setup, cgroups, and workload isolation. Kubernetes does not require Docker Engine: its built-in dockershim was removed in Kubernetes 1.24, but images built with Docker continue to work with other runtimes.
What a container runtime does in Kubernetes
Each node needs a container runtime to run Pod containers. The kubelet asks the runtime to create and manage the containers through CRI, the standard interface Kubernetes uses to communicate with runtimes. The Kubernetes Container Runtimes guide describes this requirement for Kubernetes 1.37 and cautions that readers using other Kubernetes versions should consult the documentation for their version.
As an Amazon Associate I earn from qualifying purchases.
In practice, the runtime is part of the node’s operating setup, not a feature that a cluster can do without. Its CRI integration, endpoint, cgroup configuration, and available isolation handlers all affect how the node runs workloads.
Does Kubernetes still use Docker?
It depends on what “use Docker” means. Docker Engine does not implement CRI. Kubernetes once included dockershim, a built-in bridge that let the kubelet communicate with Docker Engine, but removed that integration in Kubernetes 1.24. The Kubernetes project explains the change in its dockershim removal FAQ.
#1 Best Overall
This did not make Docker-built images incompatible with Kubernetes. Building an image with Docker is separate from choosing the runtime on a cluster node; Docker-produced images continue to work with other runtimes, as the Kubernetes project clarified in its Kubernetes 1.24 changes article.
If a cluster specifically needs Docker Engine as its node runtime, Kubernetes documents cri-dockerd, an adapter that provides the CRI connection. That is a runtime compatibility choice, not a requirement for images built by Docker.
Runtime options and how to choose
Kubernetes documentation covers containerd, CRI-O, Docker Engine connected through cri-dockerd, and Mirantis Container Runtime. The sources do not identify one universally best option. Choose based on the cluster’s Kubernetes version and support requirements, operational familiarity, Docker Engine dependencies, configuration needs, and isolation requirements.
| Option | What to consider |
|---|---|
| containerd | A CRI-capable runtime covered by Kubernetes documentation. Check that the CRI plugin is enabled; some packaged configurations disable it. |
| CRI-O | A CRI-capable runtime covered by Kubernetes documentation. Follow the setup guidance for the specific Kubernetes and CRI-O versions. |
| Docker Engine with cri-dockerd | Use this route if Docker Engine itself is required as the node runtime. Docker Engine alone does not implement CRI. |
| Mirantis Container Runtime | Listed in the Kubernetes runtime documentation; verify version support and runtime-specific setup for the cluster. |
Runtime availability and setup details are version-sensitive. Check the runtime guide and the documentation for the exact runtime release before configuring nodes.
Rank #3
What runtime choice changes for node operators
CRI endpoint and plugin setup
The kubelet must reach the runtime through its configured CRI endpoint, and the runtime’s CRI integration must be enabled. This is easy to overlook with packaged containerd installations, where the CRI plugin may be disabled in the supplied configuration. Use the endpoint and installation instructions for the runtime package you actually deploy rather than assuming all packages share the same defaults.
Cgroup driver compatibility
The kubelet and runtime need compatible cgroup-driver settings. For cgroup v2, the Kubernetes runtime guide recommends the systemd cgroup driver. Its Kubernetes 1.37 documentation describes automatic kubelet detection when the relevant feature gate and runtime support are present; do not assume that behavior applies to earlier versions or unsupported runtimes.
Rank #4
Changing a node’s cgroup driver after it has joined a cluster is sensitive: existing Pod sandbox recreation can fail. The Kubernetes cgroup driver configuration guide advises care. Where feasible, replacing or reinstalling nodes through automation may be safer than changing the driver in place.
Free tools Windows power users keep installed
One-click scans. No signup required.
Workload-specific isolation with RuntimeClass
RuntimeClass lets a Pod select a configured runtime handler. This can support workload-specific runtime choices, including stronger isolation through hardware virtualization, which can add overhead. RuntimeClass is not a universal switch: the handler must be configured and supported by the CRI implementation on the nodes that will run the Pod.
Best Value
Assessing a move away from dockershim
Before changing runtimes, distinguish image-building workflows from dependencies on Docker Engine in the cluster. The Kubernetes migration checklist identifies several concrete dependencies to look for:
- Privileged Pods that run Docker commands or otherwise expect Docker Engine on a node.
- Scripts or agents that restart the Docker service or modify Docker-specific files such as
/etc/docker/daemon.json. - Private registry credentials, image mirror settings, or other image-pull configuration that must be recreated for the new runtime.
- Telemetry and security agents that depend on dockershim-specific behavior or Docker Engine interfaces.
Inventory these dependencies before selecting a replacement. Then validate the new runtime’s CRI endpoint, plugin state, cgroup settings, image access, and any workload-specific RuntimeClass handlers against the versions actually deployed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
