containerd/containerd

Features

• Container Runtimes - Executes and supervises container processes on a host system as a core container runtime.
• Container Lifecycle Managers - Handles the full lifecycle of pods and containers, including image retrieval and process execution.
• Container Orchestration Platforms - Acts as a low-level runtime component providing interfaces for orchestration platforms to manage container lifecycles.
• Container Runtime Interfaces - Implements standardized runtime specifications for executing container images.
• Container Runtime Managers - Manages the lifecycle, configuration, and execution of container runtime instances as a core orchestration backend.
• Container Storage Drivers - Manages and stacks filesystem layers for containerized environments using pluggable storage drivers.
• Content-Addressable Storage - Uses content-addressable storage to manage immutable image layers indexed by cryptographic hashes.
• Container Image Management - Stores and retrieves container images and their constituent layers as immutable blobs indexed by cryptographic hashes.
• Runtime Specifications - Adheres to industry-standard specifications to ensure compatibility across different host systems.
• Rootless Container Runtimes - Runs the container runtime and managed workloads as a non-privileged user by leveraging kernel user namespaces to isolate system access.
• Plugin-Based Architectures - Features a modular, plugin-based architecture for extending storage, runtime, and networking capabilities.
• Shim Execution Models - Utilizes a shim-based execution model to delegate low-level operations and support diverse environments.
• Container Daemons - Integrates with init systems to manage daemon lifecycles and cgroup hierarchies without interrupting container processes.
• Image Integrity Verification - Enforces security policies by validating image signatures before allowing pull operations.
• Container Isolation Technologies - Enforces kernel-level security policies and resource constraints to isolate containerized workloads.
• Container Orchestration Management - Groups multiple containers into a single sandbox primitive to share host resources and maintain a unified lifecycle.
• Filesystem Storage Drivers - Uses pluggable storage drivers to create and mount thin-provisioned filesystem layers for containers.
• gRPC Administrative Interfaces - Provides a gRPC-based interface for remote infrastructure control and container lifecycle management.
• Container-Based Sandboxes - Creates and manages isolated execution environments for containers using configuration files to define boundaries.
• Namespace Isolation - Organizes containers and images into logical namespaces to allow secure resource sharing on a single host.
• Infrastructure and Automation - Industry-standard container runtime.
• Container Runtimes - An open and reliable container runtime.
• Go Projects - Listed in the “Go Projects” section of the Awesome For Beginners awesome list.
• Container Image Registries - Retrieves container images from standard-compliant registries to prepare them for execution on the host system.
• Container Management Daemons - Integrates custom runtime, storage, and interface implementations by loading modules without requiring a full daemon recompile.
• Container Security - Applies kernel-level security mechanisms to container processes to restrict system calls and isolate workloads from the host.
• Cgroup Driver Configurations - Selects the underlying driver for managing container cgroups to ensure compatibility with host system init processes and resource management policies.
• Container Networking Tools - Manages network namespaces for pods by integrating with network plugins to ensure connectivity and isolation.
• Metrics Exporters - Exposes daemon and container-level performance data in standard formats for external collection.
• Hardware Resource Exposure - Standardizes how hardware like GPUs are described and accessed by containers to ensure consistent resource availability.
• Command Shims - Offloads low-level start and stop operations to external runtime shims to ensure isolation and support for diverse environments.
• Programmatic Clients - Provides a programmatic client package for direct infrastructure control by external applications.
• Container Garbage Collection - Identifies and removes orphaned system resources to maintain storage efficiency.
• Image Decryption - Unpacks encrypted image layers during the pull process using local keys and decryption metadata.
• Layer Flatteners - Transforms compressed image layers into mountable filesystem snapshots by applying layer diffs to committed snapshots.
• Cgroup Drivers - Configures system resource management drivers to ensure compatibility between container execution and host-level supervision.
• Storage Backend Integrations - Integrates custom external snapshot plugins via a standard interface to support specialized filesystem storage requirements.
• Container Security - Enforces strict read-only access across filesystem mounts to prevent unauthorized modifications.
• Plugin Security Policies - Enforces security policies by selectively disabling specific container configuration adjustments and requiring mandatory plugins for container creation.
• Registry Access Controls - Configures TLS verification, custom certificate authorities, and client certificates to authenticate and encrypt communication with container registries.
• Security Isolation Mechanisms - Assigns specific runtime handlers to containers identified as untrusted to enforce stricter security boundaries and prevent host system compromise.
• Log Routing - Forwards container standard output and error streams to external destinations using pluggable logging schemes.
• Virtualized Filesystem Layers - Unpacks container image layers into individual disk image files that can be loopback mounted or attached to virtual machines.
• Stream Management - Connects container standard streams to host-side pipes and terminals for interactive process communication.
• Container Image Caching - Delegates image pulling to background services to improve deployment performance and reliability.
• Container Runtime Integrations - Integrates external plugins to monitor container states and dynamically modify configuration settings throughout the lifecycle.
• Operation Tracing - Collects and exports diagnostic telemetry data to monitor performance and troubleshoot container lifecycle events.
• Daemon Management - Customizes runtime settings, storage paths, and metrics endpoints through a centralized configuration file.
• Remote File System Mounts - Integrates external storage backends to mount container layers directly from remote sources.
• Performance Monitoring - Captures and exports telemetry data from gRPC calls to monitor system performance.
• Integrity Verification - Protects container layers from unauthorized modification or corruption using immutable file attributes or block-level verification.
• Type-Safe Configurations - Provides type-safe configuration for modular components like snapshotters and runtimes to extend core functionality.
• Resource Lifecycle Management - Uses leases to explicitly protect resources from automatic removal and ensure availability.

Star history