CRI-O
Container runtime built specifically for Kubernetes — minimal, OCI-compatible.
Alternative to containerd and Docker. Default in OpenShift and Red Hat distros. Different from Docker: no build, no end-user CLI — just runs containers on behalf of k8s. Smaller attack surface = good for security.