Container Ecosystem#
Reference of the container runtimes, image formats, orchestrators, registries, and adjacent tooling. The ecosystem clusters around the OCI specs (image, runtime, distribution) and Kubernetes; this page maps the key products in each layer.
For the broader CNCF taxonomy, see Cloud-Native Landscape (CNCF). For DBs that run on Kubernetes, see Database Systems.
Standards (OCI)#
Spec |
Notes |
|---|---|
OCI Image |
Layered tar.gz + manifest + config; SHA-256 digests. |
OCI Runtime |
Filesystem bundle + config.json + lifecycle hooks. |
OCI Distribution |
Registry HTTP API (push / pull / list). |
OCI Artifacts |
Generic non-image artifact storage in registries. |
CRI |
Kubernetes Container Runtime Interface (gRPC). |
CNI |
Container Network Interface plugin spec. |
CSI |
Container Storage Interface plugin spec. |
SBOM (CycloneDX, SPDX |
) Software Bill of Materials formats; supply-chain. |
SLSA |
Supply-chain Levels for Software Artifacts framework. |
in-toto |
Supply-chain attestation framework. |
Sigstore (Cosign + Re |
kor + Fulcio) Keyless code signing for OCI artifacts. |
Container runtimes#
Runtime |
Org |
Notes |
|---|---|---|
runc |
OCI / Linux F. |
Reference low-level runtime; the default. |
crun |
Containers / OC |
I C-based; lighter; rootless-friendly. |
youki |
Containers / OC |
I Rust port. |
gVisor / runsc |
User-space kernel for sandbox (App Engine). |
|
Kata Containers |
OpenInfra |
Lightweight VM-per-container. |
Firecracker |
AWS |
microVM hypervisor (Lambda); Kata + Firecracker pair. |
Nabla / Unikernels |
Various |
Specialized secure runtimes. |
WasmEdge / Wasmer |
CNCF / Wasmer |
WebAssembly runtimes; container alternative for WASM. |
High-level container engines#
Tool |
Org |
Notes |
|---|---|---|
Docker |
Docker, Inc. |
Original; daemon-based (dockerd); the consumer-facing brand. |
containerd |
CNCF |
Daemon used by Docker + K8s + others; CRI-compatible. |
CRI-O |
CNCF |
Lightweight CRI runtime for K8s. |
Podman |
Red Hat |
Daemonless, rootless; Docker CLI-compatible. |
Buildah |
Red Hat |
Image builder; daemonless. |
Skopeo |
Red Hat |
Copy / inspect images between registries. |
nerdctl |
containerd |
Docker-CLI on top of containerd. |
ctr |
containerd |
Low-level CLI. |
LXC / LXD |
Standard / LF |
System containers (full OS); not OCI. |
Incus |
LinuxContainers |
LXD fork. |
Image building#
Tool |
Org |
Notes |
|---|---|---|
Docker BuildKit |
Docker |
BuildKit / buildx; concurrent + cache-efficient builds. |
Buildah |
Red Hat |
Daemonless image build. |
Kaniko |
In-cluster (Pod) builder. |
|
img |
Genuinetools |
Daemonless rootless builder. |
Podman build |
Red Hat |
Wrapper for Buildah. |
Bazel rules_oci |
Bazel |
Reproducible deterministic image build. |
ko |
Go-binary -> image; no Dockerfile. |
|
Jib |
JVM-binary -> image; Maven / Gradle plugin. |
|
nixery |
NixOS |
On-demand Nix images. |
apko + melange |
Chainguard |
Distroless apk-based builds. |
Buildpacks |
CNCF / Heroku |
Auto-detect + build (Paketo, Heroku, Google). |
Dockerfile |
Docker |
The de-facto standard build recipe. |
Containerfile |
Podman / Build |
ah Dockerfile-compatible alternate name. |
Earthly |
Earthly |
Build automation in Earthfile (Make + Docker hybrid). |
Orchestrators / schedulers#
Tool |
Org |
Notes |
|---|---|---|
Kubernetes (k8s) |
CNCF |
The dominant orchestrator; control plane + kubelet. |
Docker Swarm |
Docker |
Built-in Docker orchestration (legacy). |
Nomad |
HashiCorp |
Multi-runtime scheduler. |
Apache Mesos |
Apache |
Old-guard scheduler; declined. |
OpenShift |
Red Hat |
K8s + opinionated platform. |
Rancher / Rancher Des ktop |
SUSE |
K8s manager; lightweight K8s for dev. |
K3s |
CNCF / SUSE |
Single-binary K8s for edge / IoT. |
K0s |
Mirantis |
Single-binary K8s. |
MicroK8s |
Standard |
Snap-based single-node K8s. |
Talos Linux |
Sidero Labs |
Immutable K8s OS. |
Bottlerocket |
AWS |
K8s-native OS. |
EKS / GKE / AKS / OKE |
AWS / GCP / Azure / Oracle |
Managed K8s offerings. |
DigitalOcean K8s / Linode LKE |
DO / Akamai |
Managed K8s offerings. |
Registries#
Registry |
Provider |
Notes |
|---|---|---|
Docker Hub |
Docker |
Default public registry; rate-limited unauth. |
GitHub Container Reg. |
GitHub |
ghcr.io; integrated with GH packages. |
GitLab Container Reg. |
GitLab |
Per-project. |
Quay |
Red Hat |
Quay.io; vulnerability scanning. |
Harbor |
CNCF |
Self-hosted; OCI-compatible; scanning + signing. |
Amazon ECR |
AWS |
Public + private. |
Google Artifact Reg. |
GCP |
Replaces GCR. |
Azure Container Reg. |
Azure |
ACR. |
JFrog Artifactory |
JFrog |
Universal artifact registry. |
Nexus Repository |
Sonatype |
Universal artifact registry. |
Distribution / regist ry-2 |
Docker / |
OCI Reference open-source registry impl. |
Zot |
CNCF |
Pure OCI-spec registry; small footprint. |
Networking (CNI)#
Plugin |
Org |
Notes |
|---|---|---|
Calico |
Tigera |
BGP / eBPF; the most-deployed CNI. |
Cilium |
Isovalent / CNC |
F eBPF-based; service mesh + observability + security. |
Flannel |
CNCF |
Simple overlay; legacy. |
Weave Net |
Weaveworks |
Mesh overlay (sunset 2024). |
Kube-router |
kube-router |
BGP + IPVS. |
Antrea |
CNCF |
Open vSwitch-based. |
Multus |
Intel / OCP |
Multi-network attachment plugin. |
SR-IOV CNI |
CNCF |
Hardware NIC passthrough. |
AWS VPC CNI / Azure C NI |
AWS / Azure |
Cloud-native CNI for managed K8s. |
Storage (CSI)#
Driver |
Org |
Notes |
|---|---|---|
EBS / EFS / FSx CSI |
AWS |
Cloud-native. |
GCE PD / Filestore C SI |
GCP |
Cloud-native. |
Azure Disk / File CSI |
Azure |
Cloud-native. |
OpenEBS |
CNCF |
Container-attached storage (Mayastor, Jiva). |
Longhorn |
CNCF / Rancher |
Replicated block storage. |
Rook / Ceph |
CNCF |
Ceph operator. |
Portworx |
Pure Storage |
Commercial. |
StorageOS |
Ondat |
Software-defined storage. |
Linstor |
LINBIT |
Replicated block. |
Service mesh#
Tool |
Org |
Notes |
|---|---|---|
Istio |
CNCF |
Envoy-based; the dominant service mesh. |
Linkerd |
CNCF |
Light Rust-based; ultralight micro-proxy. |
Consul Connect |
HashiCorp |
Multi-runtime mesh. |
Kuma |
CNCF |
Envoy-based; multi-cluster. |
Open Service Mesh |
Microsoft |
Sunset 2024. |
Cilium Service Mesh |
Isovalent |
eBPF-based mesh; sidecar-less. |
Traefik Mesh |
Traefik |
Lightweight. |
Tetrate Service Bridg e |
Tetrate |
Commercial Istio. |
Security / supply chain#
Tool |
Org |
Notes |
|---|---|---|
Trivy |
Aqua |
OSS scanner: image / IaC / SBOM / Kubernetes. |
Grype + Syft |
Anchore |
Image vuln + SBOM gen. |
Clair |
Quay / Red Hat |
Image vulnerability analysis. |
Anchore Enterprise |
Anchore |
Commercial scanner + policy. |
Snyk |
Snyk |
Image + IaC + dep scanning. |
Aqua / Twistlock |
Aqua / PaloAlto |
Commercial container security. |
Sysdig Secure |
Sysdig |
Falco-based runtime + image. |
Falco |
CNCF |
Runtime threat detection (eBPF + system calls). |
KubeArmor |
CNCF |
Runtime enforcement. |
Tetragon |
Isovalent |
eBPF runtime enforcement. |
Tracee |
Aqua |
eBPF runtime tracing. |
Kyverno |
CNCF |
Policy engine for K8s. |
OPA Gatekeeper |
CNCF |
OPA-based admission control. |
Polaris |
Fairwinds |
Best-practice policy. |
Kube-bench |
Aqua |
CIS K8s benchmark. |
Kube-hunter |
Aqua |
K8s pentest tool. |
Cosign + Rekor + Fulc |
i o Sigstore |
Image signing + transparency log + keyless CA. |
Notary v1 / v2 |
CNCF |
Image signing (predecessor of Cosign-style). |
Observability for containers#
Tool |
Org |
Notes |
|---|---|---|
Prometheus |
CNCF |
Metrics scraping; the standard. |
Grafana |
Grafana Labs |
Dashboards. |
Loki |
Grafana Labs |
Log aggregation. |
Tempo / Jaeger / Zip kin |
Grafana / |
CNCF Distributed tracing. |
OpenTelemetry |
CNCF |
Vendor-neutral SDK + collector. |
Fluentd / Fluent Bit |
CNCF |
Log forwarder. |
Vector |
Datadog |
Log + metric pipeline. |
Datadog Agent |
Datadog |
Commercial. |
Splunk Conn. / OTel Collector |
Splunk |
Commercial. |
GitOps#
Tool |
Org |
Notes |
|---|---|---|
ArgoCD |
CNCF |
K8s GitOps; pull-based. |
Flux v2 |
CNCF |
K8s GitOps; pull-based. |
FluxCD (legacy) |
CNCF |
v1 sunset. |
Jenkins X |
CDF |
Jenkins-based GitOps. |
Werf |
Flant |
Build + deploy in single pipeline. |
Pulumi |
Pulumi |
IaC; not strictly GitOps. |
Crossplane |
CNCF |
K8s-native cloud-resource management. |
Operator notes#
K8s is the API, not necessarily the runtime; many high-trust environments run K8s on lightweight runtimes (Talos, Bottlerocket) with non-root containers.
Image trust, pull from signed registries (Cosign + Sigstore + Rekor); generate SBOMs; pin by digest, not tag.
Distroless / minimal images (Distroless / Chainguard / Wolfi / Alpine) reduce attack surface and CVE noise; they still carry the upstream package risk.
Rootless, Podman + crun + nerdctl-rootless avoid daemon root; Kubernetes can run rootless on K3s + containerd.
Runtime monitoring with Falco / Tetragon catches syscall-level anomalies that image scanners miss.
Network policies, default-deny + namespace-scoped policies are the bare minimum on Kubernetes; CNI must enforce them (Calico / Cilium do).
eBPF is now the default for high-performance observability + enforcement (Cilium, Falco, Tetragon, Pixie).