Container Runtime Interface (CRI)
The standardized interface (a gRPC API) the Kubernetes kubelet uses to talk to a container runtime. Thanks to the CRI, Kubernetes can run on top of any runtime that implements it — containerd, CRI-O, or others.
Background: early on, Kubernetes was tightly coupled to Docker via an internal "shim". The CRI (2016) abstracted that away: the kubelet speaks CRI, and any runtime that implements CRI can be plugged in. It enabled the move away from Docker — the infamous "dockershim" removal in Kubernetes 1.24 (which caused panic but in practice affected few, since Docker images still run fine via containerd). Today the most common CRI runtimes are containerd (the de facto standard) and CRI-O (Red Hat). Beneath them sits a lower-level runtime (runc) that actually starts the container. Win: Kubernetes is runtime-agnostic — you can switch to a more secure runtime (gVisor, Kata) without changing Kubernetes. A foundational abstraction in the cloud-native stack. Related to image layer and rootless container.