Esta página se muestra en inglés. Una traducción al español está en curso.
SkillsApr 16, 2026·3 min de lectura

CRI-O — Lightweight Container Runtime for Kubernetes

An OCI-compatible container runtime designed specifically for Kubernetes. CRI-O implements the Container Runtime Interface (CRI) with minimal footprint, providing a stable and secure alternative to Docker and containerd.

AI Open Source
AI Open Source · Community
Listo para agents

Instalación con revisión previa

Este activo requiere revisión. El prompt copiado pide dry-run, muestra escrituras y continúa solo tras confirmación.

Needs Confirmation · 64/100Política: confirmar
Superficie agent
Cualquier agent MCP/CLI
Tipo
Skill
Instalación
Single
Confianza
Confianza: Established
Entrada
CRI-O Overview
Comando con revisión previa
npx -y tokrepo@latest install 8cc08d53-39d2-11f1-9bc6-00163e2b0d79 --target codex

Primero dry-run, confirma las escrituras y luego ejecuta este comando.

TL;DR
CRI-O is a lightweight OCI container runtime built specifically for Kubernetes CRI.
§01

What it is

CRI-O is an OCI-compatible container runtime designed specifically for Kubernetes. It implements the Container Runtime Interface (CRI) with a minimal footprint, providing a stable and secure alternative to Docker and containerd for running pods. CRI-O does one thing well: it pulls images, creates containers, and manages their lifecycle for Kubernetes.

CRI-O targets platform engineers and cluster operators who want a purpose-built runtime without the extra features of Docker that Kubernetes does not use.

§02

How it saves time or tokens

CRI-O has a smaller attack surface than Docker because it only implements what Kubernetes needs. No daemon, no build system, no swarm mode. Fewer moving parts mean fewer things to debug, patch, and monitor.

CRI-O versions are locked to Kubernetes versions (CRI-O 1.29 for Kubernetes 1.29), so compatibility is guaranteed and upgrade planning is straightforward.

§03

How to use

  1. Install CRI-O from the package repository for your distribution
  2. Configure kubelet to use CRI-O as the container runtime
  3. Start the CRI-O service: systemctl enable --now crio
  4. Deploy Kubernetes with kubeadm or your preferred installer
§04

Example

# Install CRI-O on Ubuntu/Debian
OS=xUbuntu_22.04
VERSION=1.29

curl -fsSL https://pkgs.k8s.io/addons:/cri-o:/stable:/v$VERSION/deb/Release.key |
  gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg

echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://pkgs.k8s.io/addons:/cri-o:/stable:/v$VERSION/deb/ /" |
  tee /etc/apt/sources.list.d/cri-o.list

apt-get update && apt-get install -y cri-o
systemctl enable --now crio

# Verify CRI-O is running
crictl info
§05

Related on TokRepo

§06

Common pitfalls

  • CRI-O cannot build images; you need a separate tool like Buildah, Podman, or Kaniko for image builds
  • CRI-O version must match your Kubernetes version; mixing versions causes incompatibilities
  • Debugging is done with crictl instead of docker commands; operators need to learn the CRI CLI

Preguntas frecuentes

How does CRI-O compare to containerd?+

Both implement the Kubernetes CRI. containerd is more general-purpose and used outside Kubernetes (Docker uses it internally). CRI-O is purpose-built for Kubernetes only, with a smaller codebase and attack surface. Performance is comparable.

Can I use CRI-O with Docker images?+

Yes. CRI-O pulls OCI-compliant images, which includes all Docker images. Any image that works with Docker or containerd works with CRI-O. There is no image format incompatibility.

Do I need Docker installed alongside CRI-O?+

No. CRI-O replaces Docker as the container runtime. Kubernetes communicates directly with CRI-O via the CRI socket. Having both installed can cause conflicts; remove Docker if switching to CRI-O.

How do I debug containers with CRI-O?+

Use crictl, the CRI command-line tool. Commands like 'crictl ps', 'crictl logs', and 'crictl inspect' mirror Docker commands but work directly with the CRI runtime.

Is CRI-O used in production?+

Yes. CRI-O is the default container runtime for Red Hat OpenShift, one of the largest enterprise Kubernetes distributions. It is a CNCF incubating project with active development and production usage at scale.

Referencias (3)
  • CRI-O GitHub— CRI-O implements the Kubernetes Container Runtime Interface
  • Red Hat Docs— CRI-O is the default runtime for Red Hat OpenShift
  • Kubernetes Docs— Kubernetes Container Runtime Interface specification
Relacionados en TokRepo
DevOps toolsSecurity toolsFeatured workflows

Discusión

Inicia sesión para unirte a la discusión.
Aún no hay comentarios. Sé el primero en compartir tus ideas.

Activos relacionados

Floci — AWS Local Emulator Alternative

A lightweight AWS service emulator for local development and testing, providing fast startup and low resource usage as an alternative to LocalStack.

Scripts
Script Depot

Gluetun — Lightweight VPN Client Container

Gluetun is a thin Docker container that tunnels all traffic through a VPN provider, letting you route any container's network through a secure VPN connection.

Scripts
Script Depot

DokuWiki — Simple Wiki That Stores Data in Plain Text Files

Lightweight wiki engine that requires no database. Uses plain text files for storage, making backups trivial and deployments simple. Ideal for documentation, knowledge bases, and internal team wikis.

Scripts
Script Depot

NewPipe — Privacy-First YouTube Client for Android

A lightweight, free Android app that lets you watch YouTube without ads, tracking, or Google Play Services. Supports background playback, downloads, and subscriptions without an account.

Scripts
Script Depot
◈Inicio🔍Buscar👤Yo