World map

 

BM

World D6: Under the Hood

OCI, containerd and runc

You will learn: who really starts a container, the shared OCI rules, and why Kubernetes runs your images without Docker.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Your teammate panics: “Kubernetes dropped Docker! All our images are useless!” Is that right?

Watch

Your laptop~

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

Docker is a team. docker info names two helpers: containerd and runc. runc: The runtime that sets up the booth: it switches on namespaces and cgroups, starts your app, then leaves. builds the booth (namespaces, cgroups), starts your app, then leaves.

Try it

containerd: The kitchen manager: it keeps images and starts and watches containers. Docker and Kubernetes both use it. is the kitchen manager. It keeps the packs and watches the boxes. Put the relay in order, first at the top.

First step at the top. Put these in order. Use the arrows, or drag.

  • Your app runs as PID 1
  • containerd, the kitchen manager, gets the pack ready
  • containerd-shim stays to watch this one box
  • dockerd, the front counter, takes the order
  • You type docker run
  • runc switches on namespaces and cgroups, then leaves

Try it

OCI: Open Container Initiative: shared rules for images and for running them, so any runtime can cook any pack. writes the shared rules. Think standard tray sizes: every oven fits them. Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      Kubernetes 1.24 removed dockershim, its translator for Docker. What starts containers on each machine now?

      Check

      Tap each year to see how we got here.

      Tap each point on the timeline.

      You did it!

      You can now explain who really runs a container, and why Kubernetes doesn’t need Docker.

      Go deeper (optional)

      Other runtimes follow the same runtime spec, like crun, gVisor and Kata Containers. A shim lets containerd restart without stopping your boxes. Kubernetes can still use Docker Engine through the cri-dockerd adapter.

      Real mission

      1. docker info
      2. docker run -d --name web nginx:1.30-alpine
      3. ps -ef | grep containerd-shim
      4. docker rm -f web

      0 of 4 steps done · Your ticks are saved.