Container runtime

The component on each node that actually creates containers: pulling images, preparing the filesystem, applying isolation and supervising the process. Orchestrators talk to it through an interface rather than implementing it, which is why the runtime under your cluster can be swapped without any workload noticing. You meet it by name during upgrades and when a node-level failure — an image that will not unpack, a wedged process — is clearly below the orchestrator's abstraction.