{
    "content": "<section>\n  <h1>The <a href=\"..\/CRI-O\/\">CRI-O<\/a> API Specification<\/h1>\n  <p>The <a href=\"..\/CRI-O\/\">CRI-O<\/a> API is a purpose-built implementation of the <a href=\"..\/Kubernetes\/\">Kubernetes<\/a> <a href=\"..\/Container-Runtime-Interface\/\">Container Runtime Interface<\/a> (CRI). It functions as a lightweight daemon that enables <a href=\"..\/Kubernetes\/\">Kubernetes<\/a> to launch and manage <a href=\"..\/OCI\/\">OCI<\/a> compliant containers. By utilizing <a href=\"..\/gRPC\/\">gRPC<\/a> for communication, the API provides a high-performance interface for the <a href=\"..\/Kubelet\/\">Kubelet<\/a> to interact with container runtimes like <a href=\"..\/RunC\/\">RunC<\/a>.<\/p>\n  <h2>API Architecture and Services<\/h2>\n  <p>The <a href=\"..\/CRI-O\/\">CRI-O<\/a> API is divided into two core services as defined by the CRI standard:<\/p>\n  <ul>\n    <li><strong>Runtime Service:<\/strong> Handles the lifecycle of <a href=\"..\/Pods\/\">Pods<\/a> and <a href=\"..\/Containers\/\">Containers<\/a>, including sandbox creation, process execution, and resource management.<\/li>\n    <li><strong>Image Service:<\/strong> Manages the pulling, listing, and removal of <a href=\"..\/Container-Images\/\">Container Images<\/a> from remote registries.<\/li>\n  <\/ul>\n  <p>This architecture allows <a href=\"..\/CRI-O\/\">CRI-O<\/a> to remain focused strictly on <a href=\"..\/Kubernetes\/\">Kubernetes<\/a> workloads, avoiding the feature creep seen in other container engines. Detailed specifications and source code are available on the <a href=\"https:\/\/github.com\/cri-o\/cri-o\">CRI-O GitHub Repository<\/a> and the official <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/architecture\/cri\/\">Kubernetes Architecture Documentation<\/a>.<\/p>\n  <h2>Security and Linux Integration<\/h2>\n  <p>Security is natively integrated into the <a href=\"..\/CRI-O\/\">CRI-O<\/a> API. It supports <a href=\"..\/Linux\/\">Linux<\/a> security primitives such as <a href=\"..\/SELinux\/\">SELinux<\/a>, <a href=\"..\/AppArmor\/\">AppArmor<\/a>, and <a href=\"..\/Seccomp\/\">Seccomp<\/a> filters. These features are configured via the <a href=\"..\/Kubernetes\/\">Kubernetes<\/a> API and passed through the <a href=\"..\/Container-Runtime-Interface\/\">Container Runtime Interface<\/a> to the underlying runtime to ensure robust isolation between workloads.<\/p>\n  <h2>Related Topics<\/h2>\n  <ul>\n    <li><a href=\"..\/OCI\/\">OCI<\/a><\/li>\n    <li><a href=\"..\/Kubelet\/\">Kubelet<\/a><\/li>\n    <li><a href=\"..\/RunC\/\">RunC<\/a><\/li>\n    <li><a href=\"..\/Containerd\/\">Containerd<\/a><\/li>\n  <\/ul>\n<\/section>",
    "tags": [
        "crio",
        "kubernetes",
        "api",
        "runtime",
        "containers",
        "oci",
        "grpc",
        "linux",
        "security",
        "orchestration"
    ]
}