CRI-O
CRI-O implements the Kubernetes Container Runtime Interface so Kubernetes can launch and manage OCI containers.
What CRI-O is
CRI-O implements the Kubernetes Container Runtime Interface so Kubernetes can launch and manage OCI containers. It supports compatible runtimes such as runc and Kata Containers, and can pull OCI images from any container registry. Building, signing, and pushing images to storage are outside the project's stated scope. For storage, CRI-O supports OverlayFS, devicemapper, AUFS, and btrfs, with OverlayFS as the default. Pod networking uses CNI, with Flannel, Weave, and OpenShift-SDN named as tested plugins. Its conmon utility monitors containers, handles logging and attach clients, and detects out-of-memory situations. Security separation can use SELinux, capabilities, seccomp, and other OCI policies. CRI-O runs on Linux, with installation guidance and packages for Debian- and Red Hat-based distributions. It follows Kubernetes release cycles and its n-2 version-skew policy. The project is community-driven, open source under Apache-2.0, and a graduated Cloud Native Computing Foundation project. Users are directed to GitHub and Kubernetes Slack for community support.
Good
- Implements the Kubernetes Container Runtime Interface
- Supports runc and Kata Containers
- Pulls OCI images from any registry
- Offers four listed storage options
- Uses CNI for pod networking
Watch out
- Runs on Linux
- Does not build, sign, or push images
- Follows Kubernetes release cycles and n-2 version-skew policy
Who it suits
CRI-O suits teams running Kubernetes on Linux that need a runtime for OCI containers. It is also relevant to operators who want CNI networking and support for multiple storage drivers.
Verdict
CRI-O focuses on running and managing OCI containers for Kubernetes, with Linux support and several networking and storage options. Image building and distribution tasks fall outside its scope.
The facts
Each one read from CRI-O's own pages, with the date it was checked.
What it does
- Image registries
- CRI-O supports OCI container images and can pull images from any container registry.checked 7 Oct 2026
- Images
- CRI-O supports OCI container images and can pull images from any container registry.checked 7 Oct 2026
- Installation
- The project site provides RPM and DEB installation instructions and notes Fedora packaging is available.checked 7 Oct 2026
- Kubernetes compatibility
- CRI-O follows Kubernetes release cycles and its n-2 version-skew policy for feature graduation, deprecation, or removal.checked 7 Oct 2026
- License
- The project repository identifies its license as Apache-2.0.checked 7 Oct 2026
- Monitoring
- The conmon utility monitors containers, handles logging, serves attach clients, and detects out-of-memory situations.checked 7 Oct 2026
- Networking
- CRI-O uses CNI for pod networking, and its site names Flannel, Weave, and OpenShift-SDN as tested plugins.checked 7 Oct 2026
- Project boundary
- Building, signing, and pushing images to image storage are outside the stated scope of the CRI-O project.checked 7 Oct 2026
- Project status
- CRI-O identifies itself as a community-driven open source project and a graduated Cloud Native Computing Foundation project.checked 7 Oct 2026
- Purpose
- CRI-O implements the Kubernetes Container Runtime Interface so Kubernetes can launch and manage OCI containers.checked 7 Oct 2026
- Release artifacts
- The v1.37.2 release page lists static bundles and describes SHA-256 checksums, cosign signatures, SPDX bills of materials, OpenVEX reports, and SLSA provenance artifacts.checked 7 Oct 2026
- Runtime support
- CRI-O supports OCI-compatible runtimes, including runc and Kata Containers.checked 7 Oct 2026
- Security
- The project describes container security separation using SELinux, capabilities, seccomp, and other policies specified by OCI.checked 7 Oct 2026
- Storage
- Its storage library supports OverlayFS, devicemapper, AUFS, and btrfs, with OverlayFS as the default driver.checked 7 Oct 2026
- Support
- The project site directs users to the #crio channel on Kubernetes Slack and the project GitHub repository.checked 7 Oct 2026
- Support and community
- The project directs users to GitHub issues and pull requests for discussions and to the Kubernetes Slack channel for chat.checked 7 Oct 2026
- Vulnerability information
- CRI-O publishes signed OpenVEX reports with releases to indicate which dependency vulnerabilities are reachable in CRI-O code paths.checked 7 Oct 2026
- Vulnerability reporting
- Security reports are handled by community volunteers, and the project says reporters can expect an initial response within three business days.checked 7 Oct 2026
Where it runs
- Linux platform
- The installation guide assumes a Linux machine and describes packages for Debian-based and Red Hat-based distributions.checked 7 Oct 2026
Alternatives to CRI-O
- 1
LXD
Free planWebAPILinuxSelf-hosted7.0From $25 a year - 2
BuildKit
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 3
Incus
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 4
Apptainer
Free planAPILinuxmacOSSelf-hosted6.7Free plan - 5
crun
Free planLinuxSelf-hosted6.5Free plan - 6
Buildah
Free planAPILinuxSelf-hosted6.4Free plan