Pod Sandbox via CRI
What does the container runtime actually do when the Kubelet asks it to start a Pod? It first builds a sandbox, a tiny pause container that holds open the network and the other shared namespaces, and then has the CNI plugin wire up the Pod IP. Then for each workload container in turn it pulls the image, creates the container and starts it inside that sandbox, so every container in the Pod shares one network identity that outlives any container restarting inside it.
Play the animation 5 steps, animated, best on a wide screen
Pod Sandbox via CRI, step by step
-
Kubelet calls RunPodSandbox with the Pod metadata, labels, and resource hints. The runtime creates a pause container that holds the network, IPC, and UTS namespaces every workload container will share by default. The PID namespace is shared only when spec.shareProcessNamespace or spec.hostPID is set.
Play from step 1 -
As part of sandbox setup the runtime invokes the configured CNI plugin with the sandbox netns path. The plugin creates a veth pair, allocates an IP via IPAM, configures routes, and returns the result. The Pod IP is now set on the sandbox.
Play from step 2 -
Kubelet calls PullImage for the app image, respecting imagePullPolicy and imagePullSecrets. The runtime fetches it from the registry into the Node image store. Under IfNotPresent Kubelet skips the call if the image is there, unless it pulled that private image with other credentials. No workload container exists yet.
Play from step 3 -
Kubelet calls CreateContainer with the sandbox id, container config (command, env, mounts), and resource limits. The runtime prepares the rootfs and the mounts and writes those limits into the OCI spec, then returns a container id. The container now exists but is not yet running, and its cgroup is created when it starts.
Play from step 4 -
Kubelet calls StartContainer with the container id. The runtime forks the container ENTRYPOINT process inside the shared namespaces of the sandbox. The Pod workload is now running and the Pod reports Ready once every container is ready, after its readiness probe passes if it has one, and any readinessGates are True.
Play from step 5