Hands-on Lab·Kubernetes and Cloud Native Associate
Pod Sandboxes and Pause Containers
Ten Pods on this node means ten pause containers doing nothing at all. That is the point: the pause container owns the network namespace so the containers that come and go can share it without losing the Pod IP.
Containers and Runtimes Guide 12 of 46 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 15 min
containerd 2.x moved its configuration layout. Paths below are 2.x; on 1.x the same settings live under different table names.
- runc1.3.6
- crictlv1.36.0
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when you want to know what a Pod is on the node rather than in the API. This matters because a Pod is a sandbox plus containers, and the pause container holding it together is invisible from kubectl while accounting for one process per Pod on every node.
- asking the runtime for a Pod by name and getting a sandbox ID back
- listing the containers that belong to one sandbox with
crictl ps --pod - counting one pause container per Pod using
ctr, containerd's own lower-level client - finding a container's runtime bundle under
/run/containerd/io.containerd.runtime.v2.task/k8s.io/
Before you start
- The runtime guide, for
crictland a working/etc/crictl.yaml. - The Pod concept. A Pod is a group of containers sharing a network namespace.
-
A Pod is a sandbox plus containers
-
Ten Pods, ten pause containers
-
Where the sandbox lives on disk