NRI

Node Resource Interface — a third-party plugin framework, distinct from containerd's own plugin system, that lets external programs hook the container lifecycle without modifying containerd. Used in production for CPU pinning, NUMA-aware allocation, and similar node-local concerns.

Purpose

• Let third parties react to container/sandbox events (RunPodSandbox, CreateContainer, UpdateContainer, StopContainer, …) and adjust the OCI runtime spec before the container starts.
• Keep this hookpoint out of CRI — NRI is invoked uniformly whether the container was created via CRI or via the containerd Go client.

Pieces

Code	Role
vendor/github.com/containerd/nri/...	The upstream NRI library
plugins/nri/	Registers the NRIApiPlugin and the runtime adapter
core/nri/	Wraps the NRI API for daemon use (translating containerd types ↔ NRI types)
internal/nri/	Internal helpers
internal/cri/nri/	The CRI plugin's NRI hookups (so RunPodSandbox/CreateContainer go through NRI)
docs/NRI.md	User-facing design doc

Configuration

[plugins."io.containerd.nri.v1.nri"]
  disable = false
  socket_path = "/var/run/nri/nri.sock"
  plugin_path = "/opt/nri/plugins"
  plugin_config_path = "/etc/nri/conf.d"

NRI plugins are external binaries placed in plugin_path (or daemon processes connecting to socket_path). Each plugin negotiates the events it cares about and the modifications it's allowed to make.

Lifecycle integration

sequenceDiagram
    participant Client
    participant CRI as CRI / Go client
    participant NRI as plugins/nri adapter
    participant Plugin as NRI plugin

    Client->>CRI: CreateContainer
    CRI->>NRI: RunPodSandbox / CreateContainer hook
    NRI->>Plugin: synchronize / event
    Plugin-->>NRI: adjustments (cgroups, env, mounts)
    NRI->>CRI: apply adjustments
    CRI->>Client: container created

NRI plugins can refuse a container creation (returning an error) or silently mutate the spec. They can also receive post-create notifications and update resource limits later.

Entry points for modification

• Disable NRI: set disable = true in the config or build with -tags no_nri.
• Add a new hook: extend core/nri/ and internal/nri/. NRI itself is upstream; the additions here are about wiring more containerd events through it.
• Custom NRI plugin: build an external binary against the upstream NRI SDK; no changes to containerd are needed.