cri-o/cri-o

Features

• Container Runtime Interfaces - Implements the Kubernetes Container Runtime Interface to manage container and pod lifecycles using OCI-compatible runtimes.
• Container Lifecycle Management - Manages the full lifecycle of containers and pods by implementing the Kubernetes CRI using OCI-compatible runtimes.
• Container Lifecycle Automation - Automates container and pod creation, cleanup, and state recovery after reboots or upgrades without manual intervention.
• CNI Plugin Integrations - Configures CNI plugins, manages network namespaces, and monitors network health for pod connectivity.
• CNI Plugin Health Monitors - Continuously checks CNI plugin health and marks the node as NetworkReady=false when a plugin becomes unhealthy.
• Container Command Execution - Runs arbitrary commands inside a running container via the exec interface, enabling debugging and administrative tasks.
• CDI Device Resolutions - Resolves and injects CDI devices into containers using the dedicated CRI field.
• Pod Lifecycle Managements - Creates and manages Kubernetes pods as groups of containers with shared namespaces through the CRI.
• Container Image Management - Downloads, verifies, and stores container images with trust and signature verification.
• Container Metric Collectors - Periodically calculates and saves resource usage for pods and containers, making them available on demand.
• NRI Plugin Customizations - Allows external plugins to hook into container lifecycle events and modify container configuration at runtime.
• Node Container Managers - Handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters at the node level.
• OCI Container Engines - Manages container images, pods, and containers by implementing the Kubernetes Container Runtime Interface with OCI-compatible runtimes.
• OCI Runtime Implementations - Implements the Kubernetes CRI to manage container and pod lifecycles using runc or other OCI runtimes.
• Live Configuration Reloads - Applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting the daemon.
• Container Device Interface Implementations - Injects Container Device Interface devices into containers using the dedicated CRI field.
• Container Workload Isolators - Enforces seccomp, SELinux, and AppArmor profiles to restrict system calls and isolate container workloads.
• Annotation-Based - Prevents users from specifying annotations that alter runtime fields such as systemd properties, closing a privilege-escalation vector.
• Seccomp Profile Enforcements with Fallback - Applies and monitors seccomp security profiles on containers with fallback to built-in profiles.
• Container Runtime Hooks - Injects OCI-compliant hooks during container creation to extend runtime behavior.
• Namespace Lifecycle Automators - Automates container and network namespace lifecycle management without manual configuration.
• Container Lifecycle Hook Plugins - Allows external plugins to intercept container lifecycle events and modify container configuration at runtime.
• Container Metrics Collectors - Collects resource usage metrics for CRI containers and sandboxes, exposing them for monitoring.
• Dynamic Configuration Reloading - Updates container runtime definitions and default runtime settings without restarting the daemon.
• Container - Collects resource usage metrics, traces operations, and exposes performance data for container and pod monitoring.
• Image Pull Timeouts - Sets a configurable timeout for image pull progress, allowing operators to increase or disable context cancellation during pulls.
• Pull Progress Timeouts - Sets a configurable timeout for image pull progress, allowing operators to increase or disable context cancellation on pull requests.
• Inheritable Capability Droppings - Removes and refuses to add any inheritable capabilities to containers to mitigate security vulnerabilities.
• OCI Volume Source Mounts - Attaches container images as volumes using the Kubernetes OCI volume source specification.
• Per-Volume Device Mappings - Honors per-volume device mappings specified by the Kubelet when mounting storage into containers.
• Per-Volume Mount Mapping Enforcements - Applies the mount mappings specified by the kubelet for each individual volume in a pod.
• Mount-Namespace Virtualization - Attaches to a mount namespace pointed to by an environment variable for isolation.
• Content Pinning - Marks container images as pinned to prevent garbage collection by the kubelet.
• Malicious Image Content Scanners - Scans container images for malicious sparse tar files causing memory exhaustion.
• Annotation-Based Container Spec Customizations - Applies resource configurations to containers based on workload activation annotations with per-container overrides.
• OCI Artifact Lifecycle Operations - Provides full lifecycle management of OCI artifacts including download, listing, inspection, and deletion.
• Path Assignments - Lets administrators define different runtime paths for different platforms within a runtime handler.
• Runtime Configuration Merges - Combines settings from multiple configuration files and directories into a single effective runtime configuration.
• Custom Device Allowances - Permits additional host devices, such as /dev/net/tun, to be accessible inside containers.
• Image Pull Timeout Enforcements - Aborts an ongoing image pull when the RPC context's timeout expires to prevent indefinite hangs.
• Local Image Pulls with localhost Prefix - Considers locally available images when pulling images with a localhost/ prefix.
• Automatic Reloadings - Detects changes to registry configuration and applies updated mirror settings without restart.
• Checkpoint-Based Container Restoration - Supports checkpointing and restoring containers out of the box, mirroring Kubernetes feature gate behavior.
• CRI-Based Image Policy Verifications - Reports image policy verification errors through the Container Runtime Interface.
• Automatic Reboot and Upgrade Cleanups - Automatically cleans up containers after a reboot and images after an upgrade, improving CNI resource cleanup.
• Specific Signal Stops - Sends a designated operating system signal to a container process to trigger its shutdown.
• Container Start Under Load Preventers - Prevents containers from failing to start when the node is under excessive load.
• Evented Pod Lifecycle Detections - Uses an event-driven mechanism to detect pod lifecycle changes instead of polling for improved efficiency.
• Direct Exec Sync Calls - Executes exec sync requests by calling the container runtime directly to reduce overhead.
• Terminal Container Exec Sync Fixes - Fixes exec sync calls for terminal containers, enabling proper command execution and health checks.
• Exec Timeout Duration Applicators - Ensures exec processes receive the full timeout duration, preventing premature termination.
• VM Container Restorations - Allows virtual-machine containers to resume correctly after the runtime restarts.
• OCI Artifact Layer Caches - Avoids re-pulling the same container image layers by storing them locally after the first pull.
• Creation Failure Cleanups - Cleans up container resources in the runtime when container creation fails, avoiding orphaned containers.
• Container Pause and Resume Controls - Pauses or resumes a container's processes through an HTTP API endpoint.
• GOMAXPROCS Injections - Sets a configurable floor for GOMAXPROCS in every container based on CPU request.
• Clean Shutdown Verifications - Verifies clean shutdown before wiping containers to prevent data loss from abrupt termination.
• Short Name Resolutions - Looks up short container image names using configurable alias tables and search registries.
• Registry Mirror Pull Retries - Continues pulling from a configured mirror registry when the primary registry is blocked.
• Internal Container Wipings - Moves container and image wiping responsibility from an external binary to the main server process.
• Checkpoint Image Synthesis - Saves container checkpoint archives as OCI images and pushes them to a remote registry.
• Direct Exec Sync Calls - Executes exec sync requests by calling the container runtime directly instead of through a monitor process.
• OCI Runtime Spec Status Inclusions - Returns the full OCI runtime specification in the verbose container status response.
• Uninterruptible Process Terminators - Terminates pods even when processes are stuck in uninterruptible sleep states.
• Resource Overhead Passings - Stores pod-level resource overhead and passes them to NRI plugins.
• AppArmor Profile Live Reloads - Applies changes to the AppArmor profile without restarting the container runtime.
• Type Specifications - Specifies the runtime type (OCI or VM) for each runtime entry in the configuration.
• Inheritance Mechanisms - Uses storage settings from storage.conf when the runtime config does not specify them.
• Container Storage Corruption Recoveries - Detects and repairs container storage inconsistencies after unclean shutdowns or missing link directories.
• Reboot Image Layer Recoveries - Restarts the container runtime after an unexpected reboot without losing image layer data.
• Missing Host Path Rejections - Blocks container creation when specified host paths to mount do not exist on the host.
• Sysctl Validations - Prevents pods using host namespaces from configuring sysctls on the host system.
• Host Sysctl Modification Prevention - Blocks pods sharing host namespaces from modifying kernel parameters, enforcing security boundaries.
• Reserved CPU Pinning for System Processes - Assigns system-level commands and the container monitor to a dedicated CPU set for workload isolation.
• Container CPU, Memory, and Disk Limits - Sets a configurable minimum memory limit per OCI runtime to prevent containers from using too little memory.
• Annotation-Based CPU Limit Enforcement - Applies CPU period and quota limits to containers annotated with workload annotations, overriding default values.
• Swap Limit Configurations - Sets a memory swap limit for containers as directed by the Kubelet through the CRI.
• Platform-Specific Runtimes - Configures specific runtime paths for different platforms within a runtime handler structure.
• Annotation-Based Runtime Class Restrictions - Limits which runtime classes can process specific annotations, letting admins control annotation-based features per runtime.
• Secure Image Parsing Libraries - Secures container image parsing against memory exhaustion from malicious tar files.
• Image Volume Signature Verifications - Verifies cryptographic signatures on image volume content before mounting.
• Container FIPS Opt-Outs - Allows individual containers to opt out of FIPS cryptographic compliance.
• Stdin Pipe Ownership Adjustments - Changes stdin pipe ownership to match the container user for exec sessions.
• Annotation-Based Device Access Grants - Grants containers access to specific devices like /dev/fuse through annotations.
• Annotation-Based Device Access Restrictions - Limits which host devices can be requested through annotations by defining an allowed devices list.
• Annotation-Based Device Allow Lists - Restricts host device access in containers through annotation-based allow lists.
• Default Device Path Allow Lists - Permits specific device paths in the default allowed devices configuration for containers.
• Ephemeral Session Containers - Supports temporary debugging containers that share a pod's namespaces without altering the pod's lifecycle.
• Child Leak Preventers - Prevents child processes from appearing to leak in host PID namespace containers.
• Policy-to-Namespace Mappers - Enforces different image signature policies per Kubernetes namespace.
• Live Decryption Key Path Reloads - Reloads decryption key paths without restarting the container runtime.
• Rootless Container Resource Limits - Applies cgroup resource constraints to rootless containers when cgroup v2 controllers are delegated.
• Registry Authentication Providers - Integrates external credential providers for container registry authentication.
• Release Signature Verifiers - Verifies cryptographic signatures of downloaded release bundles.
• Output Size Constraints - Limits ExecSync output size to prevent excessive memory and disk usage.
• Inheritable Capability Additions - Adds container capabilities to the inheritable set to support passing capabilities to non-root users.
• Live Profile Reloadings - Applies changes to seccomp profiles without restarting the container runtime.
• Vulnerability Report Generation - Generates OpenVEX vulnerability reports during the release process.
• Malicious Image Parsing Mitigations - Mitigates unbounded memory allocation when parsing malicious container images.
• Custom Directory Selections - Selects a specific directory path for container image registry configuration.
• Drop-In File Loaders - Loads additional registry configuration from drop-in files for flexible image source management.
• Kubelet-Driven User Namespace Enforcements - Applies user namespace configurations requested by the Kubernetes scheduler for container isolation.
• Software Bill of Materials Generators - Validates SPDX-format SBOMs of release bundles for component inventory.
• Annotation-Based Resource Limit Bypass Prevention - Prevents containers from bypassing cgroupv2 resource limits by filtering access to experimental annotations.
• Container Resource Status Reports - Includes container resource assignments in the response to a container status request.
• Runtime Feature Reports to Kubelet - Communicates which runtime features a container handler supports back to the Kubernetes kubelet.
• OpenTelemetry - Sends OpenTelemetry trace data to an external collector for distributed tracing of container operations.
• Container Lifecycle Traces - Instruments container and pod lifecycle operations with OpenTelemetry spans for observability.
• Kubelet Request Timeout Adjustments - Adjusts internal pod and container creation timeouts to match the runtime-request-timeout configured in the Kubelet.
• Runtime Request Timeout Adjustments - Adjusts internal pod and container creation timeouts to match the runtime-request-timeout configured in the Kubelet.
• Non-Root User Capability Restrictions - Controls which Linux capabilities are inheritable by non-root users inside containers to mitigate privilege escalation.
• Container Start Under Load Preventers - Prevents containers from failing to start when the node is under excessive load.
• Container Runtimes and Platforms - OCI-based implementation of Kubernetes CRI.
• Container Runtimes - Kubernetes-native container runtime implementation.

Historial de estrellas