Two small node components do the plumbing: kube-proxy for traffic, a CRI runtime for containers.

kube-proxy

Services to Pod IPs

1 WatchServices and EndpointSlices from the API.

2 Programiptables or IPVS rules on this node.

3 RouteVirtual IP traffic goes to a ready Pod IP.

Without it a Service's virtual IP is just a number. Some CNIs (Cilium) can replace kube-proxy entirely with eBPF, covered in Deck 7.

Container runtime and CRI

runs the containers

kubelet

speaks CRI

→

containerd

or CRI-O

→

runc

namespaces + cgroups

CRI is a standard interface, so Kubernetes is not tied to one runtime. Docker-built images are OCI images and run unchanged on containerd.

dockershim removal

Kubernetes 1.24 stopped talking to the Docker daemon. Nothing changes for your images; only the runtime on the node.

Debugging tip

On a node use crictl ps and crictl logs, not docker.

Sandboxed runtimes

gVisor or Kata can replace runc for stronger isolation (Deck 5).

kube-proxy builds Service routing; the runtime runs containers

kube-proxy runs on every node and implements the node-local part of Services. It watches Services and EndpointSlices and programs rules, in iptables or IPVS mode, so that traffic to a Service's virtual IP is redirected to one of the ready Pod IPs behind it. When Pods come and go, the rules are updated automatically.

The container runtime is the lowest layer. The kubelet speaks the Container Runtime Interface (CRI) to a runtime such as containerd or CRI-O, which in turn uses a low-level runtime like runc to create the Linux namespaces and cgroups that isolate a container. CRI is another example of the Kubernetes pattern of defining a standard interface and letting vendors plug in, as with CNI for networking and CSI for storage.

The much-discussed removal of dockershim in 1.24 simply meant that Kubernetes no longer included an adapter to the Docker daemon. Because images follow the OCI standard, Docker-built images run on containerd with no changes. What changes is the node tooling: crictl replaces docker for inspecting containers on a node.

Operational note: on EKS, GKE and AKS node images already ship containerd. On self-managed nodes, install containerd with the systemd cgroup driver to match the kubelet; a cgroup driver mismatch is a classic cause of nodes that never become Ready.