Hands-on Lab·Kubernetes and Cloud Native Security Associate
Container Runtime Security
The kubelet does not run containers - it asks a runtime to. That runtime has its own socket, its own namespaces and its own view of what is running, and none of it goes through the apiserver.
Cluster Component Security Guide 14 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 14 min
containerd 2.2.6 with the CRI plugin, SystemdCgroup = true. ctr is containerd's own client and talks to the socket directly, below CRI.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when the boundary between Kubernetes and the machine has to be made explicit. This matters because the kubelet runs no containers itself - it asks a runtime over a root-only socket, and that runtime's view of the node is larger than Kubernetes' own.
- finding the one socket that is the boundary, and who is allowed to use it
- asking containerd what it is running, rather than asking Kubernetes
- reading the runtime's own security-relevant settings
Before you start
- guide 12 - the component that calls this one.
-
One socket, root only
-
The runtime's own view, which is larger
-
The runtime's security-relevant settings