Kubernetes به Container Runtime Interface (CRI) نیاز دارد — API بین kubelet و engine که Pod را اجرا کند. سال‌ها Docker via shim بود؛ بعد containerd industry standard شد.

اما اگر goal فقط Kubernetes باشد — بدون embed Docker، بدون general-purpose daemon — چه؟

CRI-O پاسخ Red Hat و community است:

Lightweight Container Runtime for Kubernetes — Optimized for Kubernetes, stable, any OCI image from any registry.

یعنی CRI-only runtime — kubelet مستقیم با CRI-O صحبت می‌کند؛ OCI image pull، rootfs، runc/Kata، CNI — هیچ چیز اضافه.

CNCF Graduated — ۱۹ ژوئیه ۲۰۲۳. OpenShift، Minikube، Kubic — production-ready.

مشکل runtime عمومی روی node Kubernetes

containerd / Docker:
  CRI plugin + general API + namespaces + embed use cases
  Attack surface و complexity بیشتر

CRI-O:
  فقط CRI — kubelet → crio → OCI

CRI-O برای node density و kubelet-aligned behavior optimize شده — نه برای docker run روی workstation.

CRI-O چیست؟

CRI-O implementation Kubernetes CRI است که:

• OCI-compatible runtime (runc، Kata) را orchestrate می‌کند
• Image از هر registry OCI-compliant pull می‌کند
• Pod sandbox + application containers می‌سازد
• CNI برای networking (Cilium، Flannel، …)
• conmon برای logging، attach، OOM detection

Repo: github.com/cri-o/cri-o

Maintainers: Red Hat، Intel، SUSE، IBM، community

تاریخچه و CNCF

Adopters: Red Hat OpenShift، Lyft، Reddit، Digital Science، SUSE Kubic — ده‌ها هزار cluster.

معماری

Flow: Pod launch

┌──────────┐     CRI gRPC      ┌──────────┐
│ Kubelet  │ ────────────────► │  CRI-O   │
└──────────┘                   │  daemon  │
                               └────┬─────┘
                    ┌───────────────┼───────────────┐
                    ▼               ▼               ▼
            containers/image  containers/storage  OCI runtime
            (pull/push)       (overlayfs layers)  (runc/Kata)
                    │               │               │
                    └───────────────┼───────────────┘
                                    ▼
                              ┌──────────┐
                              │  conmon  │  ← per container monitor
                              └────┬─────┘
                                   ▼
                              container PID1
                                    │
                                    ▼
                              CNI plugin (pod network)

مراحل (از cri-o.io)

1. Kubelet درخواست launch Pod → CRI-O via CRI
2. CRI-O با containers/image image را pull می‌کند
3. containers/storage layerها را unpack → rootfs (COW overlayfs)
4. OCI spec JSON با generate tools ساخته می‌شود
5. runc (یا Kata) container process را start می‌کند
6. conmon container را monitor — log، exit code، attach، OOM
7. CNI networking Pod را setup می‌کند

اجزای ecosystem

CRI-O از پروژه‌های containers/ استفاده می‌کند — shared با Podman ecosystem:

conmon

conmon — per-container monitoring daemon:

• نگه‌داشتن pty از PID1
• forwarding logs به kubelet/CRI
• recording exit code
• OOM detection و report
• attach/exec client serving

جدا از CRI-O daemon — crash isolation.

Version Skew با Kubernetes

CRI-O Kubernetes support cycle را follow می‌کند — ۳ minor release support.

Version alignment:

KUBERNETES_VERSION=v1.32
CRIO_VERSION=v1.32

روی Fedora 40+ — یک CRI-O version per Fedora release، aligned با kubernetes package.

نصب

kubeadm (RPM — RHEL/CentOS/Fedora)

از cri-o.io:

KUBERNETES_VERSION=v1.32
CRIO_VERSION=v1.32

# Kubernetes repo
cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/rpm/repodata/repomd.xml.key
EOF

# CRI-O repo (isv:cri-o on OBS)
cat <<EOF | tee /etc/yum.repos.d/cri-o.repo
[cri-o]
name=CRI-O
baseurl=https://download.opensuse.org/repositories/isv:/cri-o:/stable:/$CRIO_VERSION/rpm/
enabled=1
gpgcheck=1
gpgkey=https://download.opensuse.org/repositories/isv:/cri-o:/stable:/$CRIO_VERSION/rpm/repodata/repomd.xml.key
EOF

dnf install -y container-selinux cri-o kubelet kubeadm kubectl
systemctl enable --now crio

kubeadm (DEB — Ubuntu/Debian)

# Kubernetes + CRI-O apt repos (see cri-o.io for Release.key URLs)
apt-get update
apt-get install -y cri-o kubelet kubeadm kubectl
systemctl enable --now crio

Bootstrap cluster

swapoff -a
modprobe br_netfilter
sysctl -w net.ipv4.ip_forward=1

kubeadm init --cri-socket unix:///var/run/crio/crio.sock

Minikube

minikube start --container-runtime=cri-o

Fedora

dnf install cri-o

پیکربندی

فایل‌های کلیدی

crio.conf essentials

[crio.runtime]
default_runtime = "runc"
log_level = "info"
cgroup_manager = "systemd"
selinux = true
seccomp_profile = "/usr/share/crio/seccomp.json"

[crio.runtime.runtimes.runc]
runtime_path = "/usr/bin/runc"
runtime_type = "oci"

[crio.runtime.runtimes.kata]
runtime_path = "/usr/bin/kata-runtime"
runtime_type = "oci"

RuntimeHandler — Kubernetes RuntimeClass برای Kata:

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata
handler: kata

Registry mirrors

/etc/containers/registries.conf:

[[registry]]
prefix = "docker.io"
location = "mirror.example.com"
insecure = false

Log level

# /etc/crio/crio.conf.d/01-log-level.conf
[crio.runtime]
log_level = "debug"

crictl — Debug و Operations

# config
cat /etc/crictl.yaml
# runtime-endpoint: unix:///var/run/crio/crio.sock

crictl pods
crictl ps
crictl images
crictl pull nginx:alpine
crictl logs <container-id>
crictl exec -it <container-id> sh
crictl inspectp <pod-id>
crictl rmi --prune
crictl stats

همان crictl که با containerd هم کار می‌کند — فقط endpoint عوض می‌شود.

Storage و Images

Snapshotter (containers/storage)

/etc/containers/storage.conf:

[storage]
driver = "overlay"
runroot = "/run/containers/storage"
graphroot = "/var/lib/containers/storage"

Image formats

• OCI image spec
• Docker schema 2 v1/v2
• Sigstore/cosign signature validation (feature جدید)

Security

CRI-O روی SELinux-enforcing host (RHEL) battle-tested است — OpenShift production path.

CRI-O vs containerd

انتخاب CRI-O: OpenShift/RHEL stack، K8s-only node، SELinux-heavy، Red Hat support.

انتخاب containerd: GKE/EKS default، embed در product، Windows node، nerdctl workflow.

هر دو CNCF Graduated — production-grade.

OpenShift و Red Hat Stack

OpenShift Container Platform CRI-O را manage می‌کند — crio.conf via Machine Config Operator.

Ecosystem Red Hat:

Pod روی node: CRI-O. Build و debug روی jump host: Podman.

Features جدید (Graduation era)

• Dropping pause container — sandbox optimization
• seccomp notify — kernel notification on blocked syscalls
• Sigstore signature validation — supply chain security
• Increased node density — kubelet-aligned performance tuning
• HTTP API — /containers/:id، /config برای observability

Troubleshooting

systemctl status crio
journalctl -u crio -f

crictl info
crictl pods --state Ready
crictl ps -a

# CNI
ls /etc/cni/net.d/
ls /opt/cni/bin/

# storage
crio-status info
df -h /var/lib/containers

CRI-O در stack P30Light

kubeadm / OpenShift node
    │
    ▼
CRI-O (crio.sock)
    ├── runc (default)
    ├── [Kata RuntimeClass](/blog/kata-containers-secure-container-runtime/) (untrusted)
    ├── [Cilium CNI](/blog/cilium-ebpf-kubernetes-networking/)
    └── crictl debug
         │
         ▼
GitOps — [Argo CD](/blog/argo-project-kubernetes-gitops-cicd/) deploys workloads
TLS — [cert-manager](/blog/cert-manager-kubernetes-tls-certificates/) for Ingress

چه زمانی CRI-O؟

✅ مناسب

• OpenShift / RHEL Kubernetes
• K8s-only node — minimal runtime
• SELinux production (government، enterprise)
• Minikube local dev با cri-o
• SUSE Kubic / microOS
• Signed images only — policy.json strict

❌ کمتر مناسب

جمع‌بندی

CRI-O runtime متمرکز بر Kubernetes است — OCI images، CNI networking، runc/Kata، conmon monitoring — بدون baggage Docker یا general embed API.

برای OpenShift و RHEL ecosystem انتخاب natural است؛ برای upstream Kubernetes گزینه معتبر کنار containerd — با version alignment دقیق با kube minor version.

قدم بعدی

1. Install guide — kubeadm + matching CRIO_VERSION
2. systemctl start crio — crictl info
3. kubeadm init --cri-socket unix:///var/run/crio/crio.sock
4. RuntimeClass با Kata برای sandbox workload
5. registries.conf — private registry mirror
6. policy.json — sigstore signed images only

منابع:

• CRI-O — Official Site
• GitHub — cri-o/cri-o
• Install Guide
• CNCF Graduation Announcement
• conmon
• crictl
• containers/image
• containers/storage

منتشر شده در P30Light — بخش زیرساخت سرور و Cloud Native.