OCI Container Runtimes

All these container runtime conform to the OCI runtime Spec

This page mentions how these runtimes are integrated with containerd specifically, although other tools like podman and cri-o can also use any of these runtimes.
You can read the containerd page to know details about containerd’s shim + runtime engine architecture.

runc

https://github.com/opencontainers/runc
First donated by docker to OCI.
runc became the reference implementaion for developing the OCI runtime spec.
Default in docker and containerd

containerd uses the default containerd-shim-runc-v2 “runtime shim” to invoke the runc.
The runc is the “runtime engine”.

crun

https://github.com/containers/crun
developed under “containers” organisation (same as podman) by RedHat
written in C
I am not sure if a containerd shim binary is available to be used with crun.

kata-runtime

https://github.com/kata-containers/kata-containers
For Hypervisor (VM) based containers
They support many Hypervisors such as Firecracker, QEMU, Cloud Hypervisor.

Earlier runv (EOL) , now kata-runtime which is part of the same kata-containers project
See software details and architecture for more details

The kata-runtime is OCI-compatible, CRI-O-compatible, and Containerd-compatible, allowing it to work seamlessly with both Docker and Kubernetes respectively.

Kata Containers 1.5 introduced the shimv2 for containerd 1.2.0, reducing the components required to spawn pods and containers (from 2N + 1 shims to 1 shim per Pod).
Now containerd can invoke kata-runtime containers using the containerd-shim-kata-v2 runtime shim.
Hypervisor acts as the runtime engine.

As of Kata Containers v3.4.0,
The CRI-O + Kata setup for k8s also uses containerd-shim-kata-v2 as runtime path while specifying the runtime type as “vm”.
An equivalent shim implementation for CRI-O is planned.

gVisor

https://github.com/google/gvisor
Provides more isolated environment for containers, than the default shared kernel containerisation
Read docs to know how it is different than VM or SELinux

containerd can invoke gVisor based containers using containerd-shim-runsc-v1 runtime shim.
gVisor uses its own runsc runtime engine.
https://gvisor.dev/docs/user_guide/containerd/quick_start/