30 Red Hat OpenShift and IBM Cloud Paks on IBM Power Systems: Volume 1
CRI uses the OCI-compatible environment for running Pods. CRI-O’s compatibility with OCI 
enables it to be pulled in from any Container registry. This feature is a lightweight alternative 
for Docker and similar services. CRI-O is available with Red Hat OpenShift.
The CRI-O architecture is shown in Figure 2-13.
Figure 2-13   CRI-O architecture 
The architecture overview that is shown in Figure 2-13 includes the following components:
/SM590000Pods are managed by a Kubelet that is based on information that is received from 
Kubernetes. The Kubelet and CRI-O communicate over CRI-gRPC API. Each pod hosts 
one or more containers from same cgroup and share common resources that are available 
in Pod.CRI-O uses CIN plug-in for network setup for the pod.
/SM590000CRI-O daemon starts a new pod that is based on Kubelet instructions that are received by 
way of Kubernetes CRI, which pulls images from the Container registry.
/SM590000The Container library unpacks the downloaded image in the Container root file system and 
stores it in the COW file system.
/SM590000After rootfs is created for container by using OCI generate tools, CRI-O creates JSON 
files with a runtime specification for the pod. The OCI-compatible run time is started based 
on the runtime specification. The default OCI run time is runc.
/SM590000Containers are monitored by using a common process that handles logging for the 
container process until the exit code ends the process.
/SM590000GitHub repository for several CRI-O components provides the following components:
– OCI compatible run time
– Containers and storage 
– Containers and images 
– Networking - CNI
– Container monitoring (common)
Some key distinguishing features for CRI-O: CRI-O limits its scope to Kubernetes. New 
features are also added based on the requirement of Kubernetes only. Primary driving factors 
include stability, security, and performance. CRI-O has limited troubleshooting capability and 
it uses Kubernetes’ CRI-API for Container-building activities.