►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
CRI: The Second Boom of Container Runtimes - Harry Zhang & Xu Wang, HyperHQ (Intermediate Skill Level)
Containers did have a boom when Docker Inc bring this concept to industry for the fist time. We then had Docker and rkt, we witnessed the start of runC and OCI. And then with the rise of Kubernetes community, all those container runtimes begin to become quite and hidden behind the orchestration layer, which is expected. But in 2017, we begin to hear more voice of container runtimes again. cri-o, containerd, Kata. But why? In this talk, we would like to say something about technical details of CRI, the killer weapon which brought new energy to "boring" container runtimes. We will introduce what is CRI spec and shim, how they are designed, how they work with CNI and CSI, also, what's the difference between those shims and why Kata is special. We will also demo how to write a CRI shim from zero. The second boom of containers is around, while this time it happens in Kubernetes community.
About Xu
Xu Wang is the CTO and Cofounder of Hyper HQ, and an initial member of Kata Containers Architecture Committee. HyperHQ created hypervisor-based open source container runtime runV (secure as VM, fast as container). runV merged with clear containers from Intel, and become Kata Containers project in Dec 2017. Hyper HQ provides hyper.sh, a runV/kata based container native Cloud. Before founded HyperHQ, Xu worked in a public cloud in China since 2011 and was working for China Mobile cloud team during 2007 to 2011. Xu had experiences on Linux Kernel, virtualization, container, and distributed storage system. And he is also a technical writer and translator on Linux, virtualization, NoSQL etc.
About Harry
Microsoft MVP of cloud computing. Feature maintainer of Kubernetes project. Mainly working on scheduling, CRI and hypervisor based container runtime i.e. KataContainers. Focusing on kube-scheduler, kubelet and secure container runtime on Kubernetes upstream as well as Hypernetes project. An active community advocator, tech speaker of LinuxCon, KubeCon, OpenStack Summit etc. Once published the book ""Docker and Kubernetes Under The Hood"" which is the best seller of container cloud area in China.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Today's
topic
is
caught
CI,
the
second
boom
of
container
and
hems.
So
today's
topic
is
the
more
about
the
container
and
hems
and
and
last
year
in
Berlin,
there
is
a
another
session
called
success
of
C
all
right.
The
brewing
hypervisor
base
containers
to
kubernetes,
as
given
by
my
my
by
my
colleague,
hurry
and
this
this
year,
that
this
miss
Tobias
is
contribute
by
by
he
and
I.
But
but
today
only
I
come
here
and
this
this
term
is
just
just
a
follow
the
last
the
year
decision
last
year,
and
it
includes
three
paths.
A
First
of
all,
it's
about
this,
a
brief
intro
in
etosha
about
this
CRI
interface,
and
then
we
will.
We
will
have
a
overview
of
the
current
CRI
implementations,
how
they,
how
they
implement,
how
they
call
that
the
container
run
hems
to
launch
the
part
and
the
same
boxes
and
and
then
at
the
last
video
we
will.
We
will
go
to
see
how
the
CRI
to
support
or
protect
the
catholic
in
the
nurse.
A
So
here
is
a
brief
history
of
the
of
the
CRI
in
her
face
and
that's
there's
a
long
storage.
It's
more
more
than
two
years
ago,
almost
three
years
there
is
a
this
rocket
from
Korres
have
Idid
the
into
the
into
the
kool-aid
as
the
second,
the
second
run.
Her
ran
ham
and
you
just
follow
the
follow
the
talker
and
at
that
ham
there
increase
increase,
are
worried
about.
A
If
people
want
to
want
to
put
more
and
more
rent
hams
into
the
couplet
and
incorporated
they
the
code,
we
will
write
twice-
maybe
maybe
maybe
three
times
or
four
times
for
four
different
runtimes,
and
this
is
not
not
not
a
faked
problem,
because
at
that
ham,
hybridize
ages,
just
join
the
community
and
try
to
become
a
desert
rent
ham.
Yes,
that's
us,
and
at
that
time
we
try
to
be
working
on
make
make
the
the
hybrid
can
have
around
him
to
be
compatible
with
the
car.
A
The
seventies
of
the
Burnham
works
in
the
in
the
couplet
and
try
to
try
to
integrate
it
into
the
into
the
couplet.
Actually
we
have.
We
have
done
the
patch,
but
at
that
time,
more
and
more
concerned
about,
is
this
too
complicated
to
add
each
each
in
each
run,
ham
in
into
the
couplet
and
this
paddock
aboard
with
the
public
code.
So
at
that
time,
that
the
issue
was
was
was
raised
almost
as
three
years
ago
and
then
there
is
a
it's.
Actually
it's
not
a
cult.
A
It's
not
the
the
original
word
literally
and
decide
the
coolest
should
not
when
they're,
either
and
I
know
the
run
have
implementation.
You
know
from
from
that
hand
that
ham,
the
the
no
team
tried
to
remove
the
odors
random
random
based
code
outside
of
kool-aid,
is
that
they
make
on
January,
granham
implementation
and
colder
than
hams
identical
a
visa
with
the
interface.
A
A
Responsible
and
its
high
performance,
so
this
becomes
the
that
he
thought
the
interface
for
the
for
the
CRI
and
the
first
interim
prime
implementation
is
the
doc
doc
doc
regime
and
then
the
first
nine
dollars
the
re
prime
adhesion
is
caught
Frankie.
This
is
contributed
by
by
the
habit
of
ice
age
to
the
kubernetes
community
and
the
just
select
Cornelius's
come
from
Greek
a
Greek
word
and
the
Frankie
is
called
from
another
from
another.
A
A
And
here
is
a
brief
introduce
of
the
introduction
of
the
Sierra
interface
and
the
left.
The
left
hat
is
a
part
about
a
couplet
itself.
There
is
a
there
is
a
single
OOP
of
the
of
the
cupola
of
the
pod
lifecycle
management
and
then
used
the
January
and
ham
to
call
to
management.
The
run
hams
here
is
the
in
the
middle.
The
CRI,
CRI
interfacing,
pin
sound
grcc
and
for
the
random
process
is
mean
about
the
sandbox
and
the
containers.
A
We
just
need
to
maintain
this.
This
interface
and
you
can,
you
can
implement,
implement
your
own
container
container
and
hams
for
the
for
the
couplet,
some
some
cool
some
some
is
for
the
traditional
containers
and
others,
maybe
further
for
the
virtual
machines
and
such
as
the
color
containers
and
to
implement
implement
a
siren
ham.
That's
that
looks
looks
not
very
difficult
when
I
hear
use
the
coop
control
to
read
something-
and
here
is
a
apart
apart
apart
food,
there
there's
two
containers
a
and
B
inside
anxiety's.
A
Firstly,
it
will
render
pass
and
box
to
create
a
sandbox
outside
and
then
create
containers
a
and
start
a
and
Caribbean
sabi,
and
this
is
in
the
in
the
bottle.
I
the
container
will
be
create
and
started
and
when
it,
when
you
want
to
remove
it,
remove
it,
you
can
stop
it
and
and
remove
the
container
from
the
pod.
That's
a
quarter
of
the
containers
that
it's
it's
it's
impurity
and
it's
it's
quite
straightforward
and
a
more
complicated.
A
A
The
couplet
used
the
CRI
to
call
the
concierge
in
the
CIA
implementation
and
it
will
create
a
stream
Sora,
and
the
stream
server
will
will
set
up
said,
have
a
server
task
for
the
for
the
stream
and
and
stream
it
to
the
to
the
API
server.
So
in
this
way
the
best
dream,
the
stream
of
you-
will
not
pass
through
the
cumulated
to
the
to
take
a
server.
It
is
just
direct
from
the
API
server
to
the
to
the
CRM
to
the
rain
hands.
A
A
Is
it
become
a
plug-in
of
the
of
the
continuity
and
will
not
run
as
a
separate
process
and
serious
krile
as
from
the
from
rahat
and
and
other
and
other
companies
in
the
in
the
community
and
and
the
last
we
will
introduce
the
frak
T
I
will
introduce
how
they
implement
the
CR.
Iron
was
the
different
different
and,
firstly,
it
will
be,
will
be
the
community
with
the
CRF
Guardian.
Actually,
the
the
the
grip,
the
grip
heart
is,
the
original
standalone.
Cr
I
can
tell
you
how
it
works.
A
The
couplet
will
use
the
CI
called
the
CRI
service.
The
CI
a--
plug-in
is
inside
container
d
and
then
the
community
will
real
code,
the
other
other
service
inside
the
continuity
and
that
random
serviceberry
will
run
the
Wyndham's
and
the
story
stories
cause
a
snapshot
and
a
thief
and
the
thief:
plug-ins
and
storage,
the
metadata
in
the
images
and
containers
plugins.
So
the
community
service
is
highly
dependent,
the
plug-in
mechanism-
and
we
just
want
to
focus
on
the
children,
hemp
hearts.
A
A
So
that's
that's
reasonable
that
quite
similar
and,
frankly,
is
be
different.
You
know
so
the
Frankie
itself
at
the
beginning,
that's
for
the
for
the
reveal
different
different
from
resi
to
to
create
the
what
are
the
the
water
eyes,
Asian
basic
containers
and
first,
the
Frankie
is
as
a
as
of
the
first
and
non
talker
random
see.
Iran
have
implementations
so
the
it's.
A
It's
called
a
called
the
hyper
D
with
which
we
obviously
to
to
create
the
Ravi
containers
and
for
some
privilege
containers,
because
it
just
used
the
dock
regime
and
photo
for
the
hyper
deep
heart
it
used
Ravi
as
a
library
the
different,
the
different
things.
Yes,
they
don't.
They
don't
use
some
at
all,
like
the
children
hand,
through
that,
through
the
command
line.
Is
that
just
a
call
it
from
the
library
interface?
So
so
there
is
no
seems
for,
for
each
precise
and.
A
So
this
is
the
most
the
most
different
part
and
then
used
to
use
the
different
parts,
the
videos
for
the
for
the
rav4,
the
Remy
container.
It
used
the
Highbury
and
for
the
for
the
talker
based
the
container
for
the
photo
for
really
to
the
part
they
it
used,
Tokushima
and
also
the
last
years
some
of
code
project.
We
have
a
has
a
unique
her,
no
support
in
the
in
the
Frankie
that
cry
similar.
That's
that
shows
used
the
CI
interface.
You
can
not
only
support
the
the
traditional
containers
you
can.
A
So,
let's
go
to
the
main
part
and
we
will
introduce
the
CRI
and
the
cotta
containers,
and
last
year
we
last
last
year,
I've
seen
the
coupe
count.
We
announced
the
container
to
protect
the
character,
Nina's
protected,
a
contribute
from
the
inhale,
clear
containers
and,
and
happily
we
post
both
the
poster
project.
I
worked
on
the
virtualization
based
container
and
ham,
and
try
to
try
to
provide
a
container
with
the
VM
levels.
A
Isolation
and
this
to
this
tuple
the
to
protect,
emerged
into
the
color
containers
and
we
work
in
the
in
the
past
month
and
try
to
and
try
to
release
the
the
1.0
in
in
the
enticements,
I
think
and
and
the
vision
of
the
the
Kara
containers
we
want
to
make
it
become
a
light
hand.
The
first
of
the
M
baster
containers,
you
know
the
the
container
a
service,
it
means
lightweight,
but
the
VM.
A
You
always
think
that
that's
highway,
that's
not
not
light,
but
we
in
the
color
containers
project
we
try
to
make
it
make
it
like
as
a
as
a
it's
like.
My
eyes
are,
can
hinder,
but
it
could
be
secure
could
be
isolated
as
a
as
a
VM
and
the
the
kurakin
dinners
based
on
the
inhale
color
containers
and
hyper-v
technologies.
Both
the
both
of
the
ran
ham
have
have
all
began
from
from
2015,
and
they
had
developed
more
than
two
years
more
than
two
years
before
the
color
containers
project.
A
So
both
the
both
the
projector
have
some
have
some
work
working
working
scenarios
in
the
in
the
production,
so
we
could
make
the
make
it
fast
into
the
into
the
color
containers
and
we
will
try
to
support
existing
user
protects
and
we
will
review
seamless
integration
with
dr.
Bernie's.
We
are
CR
interface
and
with
dr.
A
and
and
the
other
office
OpenStack
projects,
and
also
the
kurakin
dinners
will
support
multiple,
multiple
architectures,
not
only
inhale
Intel,
Architecture,
also
armor
and
the
power
and
so
on,
and
we
will
support
multi,
multiple
hypervisors,
not
only
the
Kiwi
amps,
but
also
the
Zen
and
something
else,
and
this
this
lies
about
how
the
how
the
car
works
actually
in
Kara
containers.
Each
part
is
it's
all
a
deed
by
the
by
the
hypervisor.
You
know
here
the
there
is
a
linear
kernel
inside
inside
inside
the
pod.
A
So
there
is
a
two
level,
two
level
of
isolation
and
by
the
by
this,
become
if,
if
there
is
a
exploit
in
the
in
the
application
a-
and
there
is
some
something
get
the
privilege
inside
inside
the
sandbox-
a
application-
a
that
couldn't
affect
the
hosta
and
other
other
containers
and
also
the
because
we
will
we
used
the
we
used
the
watch-
we
just
we
just
configured
on
the
water
machine
and
use
a
tiny
kernel
inside
it
and
there's
this
is
not
a
full
distributing.
Is
that
inside
the
world?
Okay,
the
pod?
A
So
it
could
be
up
very
fast,
which
we
make
it
as
fast
as
container
and
in
the
in
the
previous
test,
with
some
acceleration
technology
for
the
for
the
worship,
virtualization,
add
a
layer
and
and
the
kernel
kernel
part
we
could.
We
could
launch
our
container
about
about
100
milliseconds,
so
so
we
could
call
it
secure
as
container
but
faster
faster
as
a
secures
VM
Belfast
container
and
the
color
is
seamless
integration
with
that
exist.
A
Existing
can
in
there
in
consider
ecosystem,
because
we
we
support
the
OCI
specs
and
we
try
to
try
to
implement
the
resin
comparable,
comparable
commander
lines
and
also
we
have.
We
have
a
random
library.
That's
that's
identical
with
the
the
CRI
semantics
and
test
make
it
could
could
work
with
the
stalkers
and
also
the
the
kubernetes.
A
One
we
want
to
implement
the
the
CRI
in
her
face
for
color
containers,
and
we
have
two
different
integration
methods.
The
first
one
is
cata
containers
as
a
standard
center
along
12.
That
means
you
can
just
call
Katherine
hem
like
yo,
called
the
receive
command
line,
and
it
will
use
a
compare
and
see
compatible,
come
on,
come
on,
align
command
line
interface
and
just
pass
the
the
OCI
aspects
to
it
and
they
buy.
This
way
could
work
with
continuity
and
Crowell
and
the
other
ways
we
use
it
as
a
random
leap
as
a
library.
A
The
best
that's
just
like
the
what
gråvik
works
before
the
reveal
itself
provide
provider
command
line
command
line
interface,
but
at
the
same
time
it
it
provides
some
additional
ApS
that
make
make
it
could
be
more
efficiently
work
with
the
CIO
Similac
lack
lack
of
practice
and
in
the
in
the
future
we
may
we
may
employ
implement
Kennedy
plugin.
That's
based
on
the
the
Calacanis
Wenham
that
you
in
you
need
to
call
it
from
the
command
line
and
now
I
will
introduce
them
that
the
different
implementation
method
and
the
first
one
is
about
mr.
A
Kennedy
or
Krell
this
to
a
question
quite
similar,
the
Kennedy
and
the
crowd.
You
know,
as
I
introduced
in
the
previous
previous
slides
and
the
random
heart
will,
before
the
Burnham
work,
the
the
storage
part
we
will
create.
The
the
container
container
would
have
us
and
use
the
file
system
sharing
to
to
give
the
give
the
root
access
to
the
to
the
sandbox
and
leave
the
work
to
the
mm
and,
on
the
other,
on
the
other
side,
the
Ren
Hammett's
will
call
the
command
line
to
first.
A
A
Will
communication
with
Allah
that
the
run
ham
will
launch
the
the
container
with
through
the
the
interface
to
the
to
the
kata
agent,
with
the
translated
OCIO
all
the
ice
back
to
to
create
the
containers
inside
for
the
photo
communication
there
there's
two.
There
are
two
ways
to
communicate
from
the
outside
to
the
to
the
tutor
cada
Aden.
A
So
sorry
we
need.
We
need
a
a
proxy
to
do
the
to
do
the
mock
multiplex
to
support
the
multiple,
multiple
connection
from
the
during
hem
and
the
shim
shim
go
to
the
send
command
to
the
to
the
agent
inside
and
if
the,
if
the
house-to-house
the
kernel
or
the
hypervisor
support
we
saw,
we
saw
the
Razak
is
contributed
by
the
the
Vermeer
and
is
support.
A
I
think
is
support
by
since
three
dot
and
no
cash
without
fifteen-year-old
3.18
kernel
test
support
that
we
saw-
maybe
four,
maybe
photos
zero,
then,
with
the
with
the
visa
we
can.
We
can
just
directly
ask
the
the
color
containers
resulted,
the
the
proxy,
so
the
container
itself,
Kara
even
itself,
will
be
will
become
a
GRDC
Sora
and
the
random.
A
Could
the
shim
and
the
telecom
Allah
will
connect
to
the
Razak
to
to
send
the
sender
the
command
to
the
to
the
Cara
aden,
and
here
all
the
other
designs
to
just
from
the
the
connection
status
that
is
a
bit
from
outside
to
inside.
There's,
no
reverse,
no
reverse
connection
time
in
the
agent
County
initiate
a
connection
to
the
to
the
outside.
So
there's
guarantee
the
security.
A
And
the
other
way
by
the
factory
way
we
use
the
cutter,
the
color
as
a
libraries
also
it
will
be
integrated
in
the
fraction
in
the
factory
process
and
thus
to
dreams
include
of
dreams
will
be
will
be
implemented
inside
the
inside
the
the
fractal
process.
So
there
there
won't
be
a
regime
here
because
that's
the
color,
the
color
idn't
through
the
were
cereal
or
we
stock.
Even
we
need
a
multiplex
because
we
can
do
it
either
in
the
cattle
EEP.
A
So
that's
that's
the
the
new
progress
in
the
indicator,
products,
and
and
because,
because
we
can,
we
can
just
call
the
color
green
ham.
Liébana
called
the
sandbox
directly.
So
not
only
with
the
file
system
sharing,
we
can
also
use
the
block
device
old
network
storage
further
for
the
footer
container
would
have
has
and
and
other
volumes
and
that
make
it
flexible
and
at
the
end
we
also
passed.
The
also
also
translated
also
see
is
back
into
the
into
the
VM
to
create
the
containers
inside
inside
the
VM
and
for
the
comparison
that.
A
For
the
for
the
for
the
cryo
and
occasionally
implementations,
we
could
share
share
more
code
path,
but
for
the
for
the
for
the
for
the
practice,
because
we
can
save
some
some
shims
and
the
proxy
process
because
we
don't,
we
don't
need
more
Pro
when
vampers
ranking
general
and
shim
process
and
less
than
box
of
one
proxy
and
and
for
the
photo
resources.
Andrew
Travis
and
we
all
have
a
more
choice
and-
and
we
have,
we
can
add
our
own-
that
networking
plugins
for
the
voyage.
A
The
necks
of
the
necks
of
the
frankly
there
will
be
first
of
we
will
try
to
try
to
make
the
part
of
the
becomes
the
plug
in
for
the
continuity.
You
know
we
we
just
try
to
avoid
it
to
split
the
the
community
to
different
parts.
We
want
to
share,
share
more
happy
with
other
projects,
and
we
don't.
We
don't
need
too
many
implementations
for
the
same
things.
So
we
will
try
to
try
to
make
the
mixer
cut
up.
A
Has
the
color
containers
part
and
we
related
the
storage
parts
to
become
the
plug-in
for
the
photos
for
the
continuity
and
also
also
our
other
supports
that
could
like
the
Peconic
current
fratty,
it
could
cut
of
the
character
agent
directly.
We
thought
without
talk
to
to
the
to
manage
teams
and
and
proxies
to
save
the
additional
additional
process
and
digital
memories,
and
also
we
will
we
will,
by
the
by
the
release
of
the
of
the
tata
color
1.0.
We
could.
A
We
could
have
the
integration
with
the
cutter
randomly
and
also
we
improved
the
other,
enhance
and,
and
that
that's
that's
about
the
next
part
of
the
of
the
refractory
and
for
the
photo
release
in
this
in
this.
In
this
Cooktown
we
have.
We
have
many
related
sessions
and
about
firstly
about
cutter
containers.
There
will
be
about
except
this
one.
There
will
be
one
two
three
four
four
four
session
from
different
different
member
of
the
kurakin
dinners
community.
A
They
will
introduce
the
all
of
the
different
pathways
for
the
different
audio,
attended
audience
levels
and
also
for
the
container
security.
Is
it
become
more
and
more
hot
hot
topic
for
the
for
the
coup?
Bernie
Cabrini's
come
in
here,
I'd
like
to
see
this
one
and
tomorrow
will
be
a
topic
from
from
Google,
and
they
will
really
introduce
them
very
interesting
implementation
of
their
container
security
methods
and
I
think
yeah.
That's
that
will
be
a
complementary
part
for
the
Kara
containers
and,
and
that
that's
all-
and
if
do
you
have
any
questions,
please.
B
A
C
B
A
C
C
A
Yes,
that's
possible.
I.
Think
the
cotta
containers
itself
depends
on
very
few
means
more
than
Linux
features
actually
in
the
in
the
Gaston
I
think
so
for
the
gas.
If
you
you
don't
don't
want
the
optimization
for
something
like
resource
or
something
else
you
can
just.
We
saw
with
older
in
this
kernel
and
wisdom
with
some
options
that
has
to
be
to
be
the
VM
caster
and
some
something
like
inside
it
may
enabled
that
will
be
work,
but
I
think
that
will
be.
A
We
need
some
in
some
tuning
for
it
in
the
in
in
the
container
project
there
there
is
a
novel
of
an
opening
PAPR
for
the
for
the
kernel
configure
regions.
So
you
can
you
can
reference
the
configuration
to
see
what
what
is
the
the
essential
parts
for
the
essential
Colonel
Colonel
configuration
for
the
for
the
gas
kernels,
okay.
B
A
Else,
yes,
the
network
party
is
an
addressing
in
the
in
this
topic.
Actually
there's
two
ways
for
the
for
the
for
the
44.
These
ways
we
call,
we
call
it
with
with
the
address
Razia
compatible
command
lines.
So
this
means
the
the
outside
ablative
you
have
already
created
and
the
net
less
for
it,
and
the
the
united
prague
ins
will
practice
the
network
to
the
to
the
names
basis.
So
we
need
to.
A
We
need
to
get
the
configuration
from
the
from
the
from
the
not
unless
and
maybe
set
a
set
up
a
bridge
to
the
from
to
set
up
from
the
s
to
the
to
the
to
the
VMS.
But
that's
we
will
will
waste
some
some,
some
psychos
and
and
the
reduce
the
reduce
the
throughput
for
the
forum
for
the
networking
and
also
if
we
could
have
our
own
senior
plugins,
we
with
the
plugin
we
could.
We
could
just
skip
the
namespace
from
the
from
the
outside
preacher
and
the
vm
we
can.