containerd Workshop – Overview
Overview
This workshop covers the path from container runtime fundamentals to secure Kubernetes node operations with CRI, OCI, registry, snapshotter and RuntimeClass concepts.
The focus is on:
- containerd architecture
- OCI image, runtime and distribution
- content store, metadata store and snapshotters
- container, task, process and shim
ctr,nerdctlandcrictlas different tools- CRI integration with Kubernetes
- registry
hosts.toml, mirrors and TLS - CNI handoff, cgroups, rootless mode and RuntimeClass
- security hardening, image verification and incident response
Quickstart
# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_containerd.sh
./scripts/provision_containerd.sh --dry-run
Then start with the curriculum and first examples:
less docs/curriculum-containerd-EN.md
less workshops/01-fundamentals-containerd-EN.md
cd examples/00-lab-skeleton
./run.sh
Audience
This workshop is for developers, DevOps engineers, platform engineers, SREs, system engineers, Kubernetes administrators and security engineers who need to understand and operate containerd as the runtime layer.
Learning Path
| Level | Focus | Result |
|---|---|---|
| Fundamentals | Architecture, OCI, ctr, images, content, snapshotters, containers and tasks |
You understand runtime basics and can collect local evidence. |
| Intermediate | CRI, Kubernetes node, registry, CNI, cgroups, crictl, nerdctl |
You can reason about containerd in a platform context and analyze common failures. |
| Professional | Operations, upgrades, garbage collection, observability, rootless, RuntimeClass, snapshotter strategy | You can document and safely change runtime decisions. |
| Advanced + Security | Threat modeling, sandbox runtimes, seccomp, AppArmor, image trust, SBOM, incident response | You can evaluate and harden containerd in security-sensitive environments. |
Structure
Workshop Structure
This workshop follows the same structure as the Kubernetes workshop. The topic changes, the navigation model stays consistent.
Prerequisites
- Linux, WSL, VM or bare-metal test system
containerd,ctrandruncfor runtime labs- optionally
nerdctl,crictl,kubectl, CNI plugins and a local registry - do not use production nodes, registries, pull secrets or cluster endpoints for labs
Working Mode
All examples create runtime artifacts below work/. These artifacts are ignored and may contain temporary configuration or evidence. Only safe lab configuration and documentation are versioned.
Official Sources and Boundary
- containerd documentation, getting started and configuration: https://containerd.io/docs/2.3/getting-started/
- containerd registry
hosts.toml: https://github.com/containerd/containerd/blob/main/docs/hosts.md - containerd runtime v2 and shim model: https://github.com/containerd/containerd/blob/main/docs/runtime-v2.md
- Kubernetes container runtimes: https://kubernetes.io/docs/setup/production-environment/container-runtimes/
- Kubernetes Container Runtime Interface: https://kubernetes.io/docs/concepts/containers/cri/
- OCI Image Specification: https://github.com/opencontainers/image-spec
- OCI Runtime Specification: https://github.com/opencontainers/runtime-spec
- Open Container Initiative: https://opencontainers.org/
This workshop does not introduce a containerd API. It maps official concepts into labs, review questions and operational workflows. When a file describes a model, it is explicitly framed as a model or lab artifact.