What is the Open Container Initiative (OCI), containerd, and runc?
❓ Interview Prompt: Explain OCI image-spec and runtime-spec standards, containerd as the high-level runtime, and runc as the low-level container executor.
The container ecosystem is built on open standards to prevent vendor lock-in:
Open Container Initiative (OCI):
An open governance body (Linux Foundation) that defines two specifications:
Execution Stack:
dockerd → containerd (gRPC) → containerd-shim → runc → container process
containerd (High-Level Runtime):
An industrial-grade container runtime (donated by Docker to CNCF) that manages the full container lifecycle:
runc.runc (Low-Level OCI Runtime):
A CLI tool that implements the OCI runtime-spec — it reads the config.json bundle and:
After starting the container, runc exits — the container runs without runc.
Code Implementation Example
# containerd is the runtime used by Kubernetes
crictl --runtime-endpoint unix:///run/containerd/containerd.sock ps
# runc is the low-level OCI runtime
# Manually run a container via runc (what containerd does internally):
mkdir -p /tmp/mycontainer/rootfs
docker export $(docker create alpine) | tar -C /tmp/mycontainer/rootfs -xf -
cd /tmp/mycontainer
runc spec # generates config.json from OCI spec template
runc run mycontainer # execute container process directly
# Verify OCI image compliance
skopeo inspect docker://myapp:latest | jq '.MediaType'
# "application/vnd.oci.image.manifest.v1+json" ← OCI compliantOCI defines portable image/runtime standards. containerd manages lifecycle; runc creates namespaces/cgroups and executes the process. Any OCI-compliant runtime can replace runc.