🏃 Container Runtime

// kubelet/pkg/kubelet/kuberuntime/kuberuntime_manager.go

// SyncPod creates the pod sandbox if necessary, and then
// creates containers in the pod.
func (m *KubeGenericRuntimeManager) SyncPod(
    ctx context.Context,
    pod *v1.Pod,
    _ container.PodStatus,
    _ *v1.PodStatus,
    pullSecrets []v1.Secret,
    _) error {

    // Step 1: Pull images
    if err := m.pullImages(...); err != nil { return err }

    // Step 2: Create pod sandbox (pause container)
    podSandboxID, _, err := m.createPodSandbox(ctx, pod)
    if err != nil { return err }

    // Step 3: Create containers
    for _, container := range pod.Spec.Containers {
        if err := m.createContainer(ctx, pod, container,
            podSandboxID, pullSecrets); err != nil { return err }
    }

    // Step 4: Start containers
    for _, container := range pod.Spec.Containers {
        if err := m.startContainer(ctx, containerID); err != nil { return err }
    }
    return nil
}

// CRI v1alpha2 API (containerd CRI plugin)

rpc RunPodSandbox(RunPodSandboxRequest) returns (RunPodSandboxResponse);
rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse);
rpc StartContainer(StartContainerRequest) returns (StartContainerResponse);
rpc StopContainer(StopContainerRequest) returns (StopContainerResponse);
rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse);
rpc ExecSync(ExecSyncRequest) returns (ExecSyncResponse);

// RunPodSandbox → creates the pause container that holds the
// network namespace (net ns) for all containers in the pod.
// All containers join this net ns via --network=container:<sandbox>

message RunPodSandboxRequest {
    string runtime_config = 1;  // Kubernetes uses linux for ns
    map annotations = 2;
    string hostname = 3;
}

message CreateContainerRequest {
    string pod_sandbox_id = 1;   // from RunPodSandbox
    string config = 2;           // ContainerConfig protobuf
    string image = 3;            // ImageSpec
}

// containerd/services/containers/service.go

// NewContainer creates a new container metadata record in bolt DB
func (s *Service) NewContainer(ctx context.Context, req *api.CreateContainerRequest) {
    container := containers.Container{
        ID:        req.ID,
        Runtime:   req.Runtime.Name,
        RootFS:   req.RootFS,  // snapshotter reference
        Labels:    req.Labels,
        CreatedAt: time.Now(),
    }
    // Write to bolt DB (transactions are serialised)
    tx := s.db.Writer()
    bkt := tx.Bucket([]byte("containers"))
    bkt.Put([]byte(req.ID), marshal(container))
}

// containerd/snapshots/overlay/overlay.go

// Prepare unpacks image layers into a snapshot
func (sn *snapshotter) Prepare(ctx context.Context, key string, parent string) error {
    // 1. Mount the parent snapshot
    // 2. Apply the diff (untar image layer)
    // 3. Create an overlay mount: upperdir=this layer, lowerdir=parent
    mount := overlayMount(upperdir, lowerdirs, workdir)
    return sn.storeMount(key, mount)
}

// runc create → runc start

// Step 1: runc create reads config.json (OCI runtime spec)
// and sets up cgroups, namespaces, and mounts.
$ runc create --pid-file /tmp/nginx.pid \
              --bundle /var/lib/containerd/io.containerd.runc.v2/ \
              nginx

// Inside runc create:
// - config.json.spec.ROOTFS = rootfs mount
// - spec.linux.namespaces = [pid, net, ipc, mnt, uts, user]
// - spec.linux.cgroup = { devices: [deny], memory: { limit: 134217728 }}
// - pivot_root() into rootfs/
// - write pid to /tmp/nginx.pid
// - fork + execve() container process

// Step 2: runc start resumes the container (already created)
// $ runc start nginx
//   → reads pid from /tmp/nginx.pid
//   → sends container process a SIGCONT (it's frozen after create)
//   → container process begins execution at its entrypoint