Does containerd actually support OCI Runtime Specification?

[slonopotamus]

README tells me:

containerd fully supports the OCI runtime specification for running containers

But I am under the impression is that you cannot take a random runtime that implements OCI runtime spec, feed it into containerd and be happy. Instead, you would need to write a containerd shim what would talk to containerd via custom protocol.

Am I wrong and containerd does support OCI runtime specification or containerd documentation is misleading?

If OCI runtime specification is in fact not supported, what are the plans about supporting it? Maybe an open issue that can be tracked? Unfortunately, it is almost impossible to search issues for oci runtime, I get lots of unrelated results.

[cpuguy83]

OCI does not define any means of talking to an oci runtime.

There is runc, and you can configure containerd to use any runc-compatible binary.

The purpose of shims is to wire up containers to a runtime which is expected to know how to execute an OCI bundle.

[slonopotamus]

something is compatible with runc

Specifications do not work that way. There is OCI Runtime Command Line Interface. There are runtimes that implement it. But one cannot use such runtime with containerd without writing a shim.

[slonopotamus]

Okay, things are a bit trickier. Looks like what you call "runc-compatible" is OCI Runtime Command Line Interface. The problem is that in containerd it is so much tied to runc that became Linux-only.

[cpuguy83]

That is incorrect.
containerd has a runc shim, each and every runc-compatible runtime can be used with it.

[fuweid]

But one cannot use such runtime with containerd without writing a shim.

containerd-shim-runc-v2 can be compatible with any OCI Runtime Command Line interface. You use youki/crun/runc to work with the shim. However, those runtimes need to support OCI runtime spec at first.

And you can also integrate containerd-shim-runc-v2 with kata/gvisor/firecracker. But it's pain. Such runtimes are maintaining a qemu or hypervisor. That's why we suggest sandbox-like runtime authors to write there own shims so that they don't have to follow the runC like command line.

containerd fully supports the OCI runtime specification

In containerd, all the configuration about container is from OCI Runtime spec. The container configuration producer is containerd and the data consumer is runtime. containerd has builtin shim to support runC-like command, because the shim layer can help us to integrate with third party shim plugins. Again, you don't have to build your own shim.

The shim was designed for live-restore things. Back to 2016, OCI runtime implementation was only one: runC. And then kata-container joined and shim-v2 design comes. For your question (if my understand is correctly), containerd can guarantee the configuration is OCI runtime spec.

Hope it can help you.

[slonopotamus]

Well, I'm writing a runtime that is ready to follow runC command line. And runj already follows runC commandline. But neither of us can use containerd-shim-runc-v2. Because... containerd-shim-runc-v2 is Linux-only. But I understood you, thanks everyone for explanations.

[mikebrow]

containerd supports all of the OCI specifications and the opencontainers/runc runtime cli api.. together these specifications and runc resolve to OCI support.

Specifications do not work that way. There is OCI Runtime Command Line Interface. There are runtimes that implement it.

The runtime specification does not provide a specific cli/api the operations and discussion in the runtime spec are more a logical lifecycle spec discussion than an actual api. The API for the runc compatible runtime engines is owned by the runc project. That OCI decision was made early on.

The Open Container Initiative Runtime Specification aims to specify the configuration, execution environment, and lifecycle of a container.

Okay, things are a bit trickier. Looks like what you call "runc-compatible" is OCI Runtime Command Line Interface. The problem is that in containerd it is so much tied to runc that became Linux-only.

You can build containerd for multiple platforms, not just linux.

[slonopotamus]

The runtime specification does not provide a specific cli/api the operations

But it does: https://github.com/opencontainers/runtime-tools/blob/master/docs/command-line-interface.md

You can build containerd for multiple platforms, not just linux.

Yes, but not containerd-shim-runc-v2 as of today.

[AkihiroSuda]

But it does: https://github.com/opencontainers/runtime-tools/blob/master/docs/command-line-interface.md

No, it's not a part of the runtime spec.

[mikebrow]

@slonopotamus suggest reading this thread opencontainers/oci-conformance#36

windows shim: https://github.com/microsoft/hcsshim

gvisor: https://github.com/google/gvisor

... there are others who are shim v2 compatible.