- K8s 1.20: Docker runtime deprecated
- K8s 1.24: Docker runtime removed
- CRI: standard API; containerd is default on most clusters
- OCI image format unchanged:
docker build/ push still works; cluster runs via containerd
CLI tools
| Tool | Use |
|---|---|
ctr | Low-level containerd: debugging only |
nerdctl | Docker-compatible CLI for containerd: dev machine |
crictl | CRI-level: inspect/debug on K8s nodes |
Command equivalents
| Operation | docker | podman | nerdctl | crictl |
|---|---|---|---|---|
| Build | docker build | podman build | nerdctl build | : |
| Save image tar | docker save | podman save | nerdctl save | : |
| Load image tar | docker load | podman load | nerdctl load | : |
| Tag | docker tag | podman tag | nerdctl tag | : |
| Push | docker push | podman push | nerdctl push | : |
| Pull | docker pull | podman pull | nerdctl pull | crictl pull |
| Run | docker run | podman run | nerdctl run | crictl run |
| List | docker ps | podman ps | nerdctl ps | crictl ps |
| Logs | docker logs | podman logs | nerdctl logs | crictl logs |
| Exec | docker exec | podman exec | nerdctl exec | crictl exec |
- Image build/save/load/tag/push →
docker,podman, ornerdctlon exam workstation - Inspect pods on cluster nodes →
crictl(CRI-level, not for building images)
Exam gotchas
crictl runcreates containers not managed by kubelet: GC removes them; inspection only- On worker nodes:
crictl; on exam desktop:docker,podman, ornerdctlfor image tasks - K8s 1.24+ has no Docker shim; exam may still ship a
dockerCLI (often aliased to podman) - OCI image tar from
docker saveworks withpodman loadand vice versa