CRI-O Still Loves Kubernetes

on YouTube ↗33m

" summary

CRI-O replaces dockershim as a Kubernetes-only runtime and shows concrete fixes: improved CRI metrics and kubelet communication under load, a new cache-and-throttle flow that avoids repeated name is reserved errors (demo simulates a 4‑minute CNI delay), support for user namespaces 65536 mappings via runtime class annotations, seccomp profile recording using the oci-seccomp-bpf hook (requires CRI-O 1.21), and tooling like cryctl and Podman for debugging and image workflows.

AI-written summary · about

" chapters (16)

1. 0:00Introduction
2. 0:38Overview
3. 0:48Latest Features
4. 2:30Docker Shim Removal
5. 3:33Case Study
6. 4:12The Fundamental Problem
7. 4:40CRIO Before
8. 19:06Username Spaces
9. 23:13Second Profiles
10. 24:34Cons
11. 25:12Demo
12. 26:57Cryostatus configuration
13. 28:24Cryostatus second profile
14. 29:10Multiple annotations
15. 30:33Multiple profiles
16. 32:27Default profile

" related talks

• 46mCRI-O: All the Runtime Kubernetes needAntonio Mudarca · QCon São Paulo 2018
• 31mCRI-O: The Runtime Control RoomSascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon North America 2020 Virtual
• 29mCRI-O: All the Runtime Kubernetes Needs, and Nothing MoreMrunal Patel · KubeCon + CloudNativeCon North America 2017
• 38mIntroduction to CRI-OMrunal Patel, Peter Hunt · KubeCon + CloudNativeCon North America 2019
• 26mWhat's New in CRI-O?Sascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon North America 2021
• 37mCRI-O: Under the HoodSascha Grunert, Mrunal Patel · KubeCon + CloudNativeCon North America 2019
• 21mCRI-O: Secure, Performant, and Boring...Sascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon Europe 2022
• 04mCRI-O: Container Runtime IntensifiesSascha Grunert · KubeCon + CloudNativeCon Europe 2025