Can Kubernetes run without Docker? Explain the CRI.
Quick Answer
Yes. Kubernetes talks to container runtimes through the Container Runtime Interface (CRI), so it works with containerd, CRI-O, or any CRI-compliant runtime. Docker-shim was removed in v1.24; images are still OCI-standard and run fine.
Detailed Answer
Kubernetes never depended on Docker's higher-level tooling — it only needed something to run OCI containers. The kubelet speaks CRI, a gRPC interface, to whatever runtime is installed. Docker itself used containerd under the hood, and Kubernetes originally reached Docker via an adapter called dockershim. That shim was deprecated and removed in v1.24, so clusters now use containerd or CRI-O directly. Nothing about your images changes — they're OCI images built by Docker, Buildah, or anything else, and they run identically. The practical takeaways: 'Docker' as a runtime is gone from modern clusters but your docker build workflow is unaffected; and for sandboxed isolation you can plug in runtimes like Kata or gVisor through the same CRI/RuntimeClass mechanism.
Code Example
kubectl get nodes -o wide # CONTAINER-RUNTIME column: containerd://1.7.x
# Choose a runtime per-pod via RuntimeClass (e.g., gVisor for untrusted work)
spec: { runtimeClassName: gvisor }Interview Tip
Correct the common myth calmly: 'removing dockershim didn't break images — they're OCI-standard; the kubelet just talks CRI to containerd now.' That precision separates you from candidates who panicked at the v1.24 headline.