Glossary

Terms and acronyms used throughout the containerd codebase and this wiki.

Container

A running instance of an OCI image with its own root filesystem and process tree. In containerd, a container is the persistent record (Container in core/containers) and a task is the running process. Creating a container does not start it; you must additionally create a task.

Task

A running process associated with a container. Tasks are created/started/killed via the Tasks gRPC service; the daemon delegates to the runtime plugin which talks to the shim. See core/runtime.

Shim

A small per-container process that owns the runc/runtime invocation and the container's stdio. The default shim is containerd-shim-runc-v2 (cmd/containerd-shim-runc-v2/). It exposes a ttrpc API to the daemon and outlives daemon restarts.

Runtime v2 (io.containerd.runtime.v2)

The plugin type for shim launchers. The runc-v2 shim, runhcs (Windows), and other custom runtimes register here. Implementation of the daemon-side runtime manager: core/runtime/v2/.

Snapshotter (io.containerd.snapshotter.v1)

A pluggable backend that produces and manages the rootfs for a container. Each snapshotter implements the Snapshotter interface in core/snapshots/snapshotter.go. Built-ins live under plugins/snapshots/: overlay (default on Linux), btrfs, devmapper, native, blockfile, erofs, windows, lcow.

Content store (io.containerd.content.v1)

A content-addressable blob store keyed by digest, used to hold image layers, manifests, and configs. The default implementation is plugins/content/local. The interface is in core/content/content.go.

Metadata (io.containerd.metadata.v1)

The bbolt-backed key/value store at plugins/metadata that records images, containers, leases, sandbox state, and snapshot metadata. It wraps and unifies access to the content store and snapshotters.

Lease

An anti-GC handle. As long as a lease exists with a reference to an object (a content blob or a snapshot), the garbage collector won't delete it. See core/leases and plugins/leases.

Namespace

A logical partitioning of the daemon's objects. Two clients using namespaces kubernetes.io and default see disjoint containers, images, and leases. Namespaces are propagated through gRPC metadata; see pkg/namespaces.

CRI (Container Runtime Interface)

The Kubernetes-defined gRPC interface (runtime.v1.RuntimeService, runtime.v1.ImageService) that the kubelet uses to launch pods. containerd implements CRI as a built-in plugin under internal/cri/.

Sandbox

In CRI terminology, a "pod sandbox" is the network/IPC namespace shared by containers in a Kubernetes pod. containerd has a Sandbox plugin type and a sandbox controller (internal/cri/server/podsandbox and plugins/sandbox).

NRI (Node Resource Interface)

A plugin framework, distinct from containerd's plugins, where third parties can hook the container lifecycle (e.g., to assign CPU sets). Implemented at plugins/nri/ and internal/nri/.

Transfer service

A higher-level service that bundles pull/push/import/export with progress events. See plugins/transfer and core/transfer. Newer clients prefer this over calling the lower-level Images/Content services directly.

ttrpc vs gRPC

containerd uses gRPC for client-facing APIs and ttrpc (github.com/containerd/ttrpc) for the daemon ↔ shim channel. ttrpc is a lighter framing protocol designed for trusted local communication; it avoids HTTP/2's overhead.

OCI (Open Container Initiative)

The standards body whose specs containerd follows: image-spec, runtime-spec, distribution-spec. Helpers for OCI specs are in pkg/oci.

Differ (io.containerd.differ.v1)

A plugin that computes layer diffs and applies them. Built-ins: walking, erofs, windows, lcow. See core/diff for the interface.

Streaming (io.containerd.streaming.v1)

A daemon-managed broker for bidirectional streams that span gRPC calls — used by transfer, attach/exec stdio, etc. See plugins/streaming and core/streaming.

Mount manager / mount handler

A v2.x abstraction for delegating filesystem mounts to a separate handler (e.g. plugins/mount/erofs, plugins/mount/fsview). The manager negotiates between snapshotters and shims.

Image verifier

A pluggable hook that runs an external binary on each image to authorize use. Implemented at plugins/imageverifier/bindir.

ctr

containerd's bundled CLI used for development and debugging — not a stable user-facing tool.

crictl

A CLI from the kubernetes-sigs/cri-tools project used to exercise the CRI plugin. Used for CRI validation testing.

criu

Checkpoint/Restore in Userspace; required if you want to checkpoint and restore live containers. Used by pkg/checkpoint and the runc shim.

CNI

Container Network Interface — the network plugin standard. containerd does not handle networking itself; the CRI plugin invokes CNI plugins for pod sandboxes. See vendor/github.com/containernetworking/cni.