containerd vs firecracker-containerd

containerd is a free container runtime for managing a host’s container lifecycle. It handles image transfer and storage, execution, and supervision, and is designed to be embedded in a larger system rather than used directly by developers or end users. It supports OCI images and image push and pull operations, and uses runc by default while allowing other OCI-compliant runtimes. Its built-in CRI plugin can make it the container runtime for a Kubernetes cluster, and it supports registries compliant with the OCI Distribution Specification. The daemon is available for Linux and Windows. Network-interface management and image building are outside containerd’s first-class scope, so higher-level systems or tools handle those jobs. Its ctr command-line tool is intended for development and debugging, without a guarantee of a stable interface or a human-friendly experience. Users typically also need runc and CNI plugins. The plan is free; free plan available, with no free trial.

firecracker-containerd lets containerd manage containers as Firecracker microVMs, adding isolation through the KVM hypervisor. Potential uses include sandboxing untrusted third-party containers and bin-packing different workloads on multi-tenant hosts. It uses OCI image format where possible. The project includes a control plugin and API, an out-of-process shim runtime, an agent inside the microVM, and a root filesystem image builder. That agent invokes runC through containerd-shim-runc-v1 to create Linux containers inside the microVM. Networking supports pre-created tap devices and tap devices created by CNI plugins such as bridge, ptp, host-local, firewall, and tc-redirect-tap. The software is free under Apache 2.0. Hosts require Linux 4.14 or later, Intel x86_64, and KVM; AMD and Arm are not supported. Building requires git, gcc, Docker CE, and Go 1.23 or later. The guide describes the project as very early, and multi-tenant use is at the user’s own risk.