Let’s break the workflow :
When a request comes to start a #container, #kubelet calls the CRI that invokes the internal CRI-O daemon in the #kernel
The daemon uses a compliant storage and image library on disk
The CRI-O interacts with a remote registry to pull the image if not present on disk while the daemon exposes a [#grpc] server with endpoints to create, start, stop (and many more other actions) on the #containers.
Under the hood, cri-o can use any OCI-compliant [low-level] runtimes to work with containers
However the default one is again #runc that interacts with #linux kernel to invoke processes in namespace & #Cgroup context!

I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I am working at Cotocus. I blog tech insights at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at I reviewed , and SEO strategies at Wizbrand.
Please find my social handles as below;
Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at PINTEREST
Rajesh Kumar at QUORA
Rajesh Kumar at WIZBRAND