youki: From Experimental Runtime to CNCF Sandbox

▶ Watch (0:35)

youki is an OCI low-level container runtime written in Rust, comparable to runc and crun. It has around 7,300 GitHub stars and joined the CNCF sandbox in October 2024. In the Kubernetes execution stack, kubelet does not call a low-level runtime directly. It calls a high-level CRI runtime such as containerd or CRI-O, which then invokes a low-level runtime like runc or youki. youki sits at that lowest layer.

Recent Feature Additions to the OCI Spec

▶ Watch (1:52)

youki added support for net devices and Linux memory policy, both newer entries in the OCI runtime specification. Net device support matters because Kubernetes networking models now need declarative attachment of network interfaces, especially for AI, ML, and high-performance workloads. Memory policy support addresses NUMA workloads. Beyond new features, the project improved alignment with runc behavior, expanded OCI runtime conformance tests, and fixed stability bugs including seccomp-related issues.

Roadmap Item 1: Closing the Gap with runc

▶ Watch (3:33)

OCI spec compliance is necessary but not sufficient for real-world compatibility. Commonly used features such as exec, update, and checkpoint fall outside the specification. Runtime behavior can also diverge in ways the spec does not define. The goal is to match runc behavior in real environments, specifically Kubernetes. The next concrete step is expanding compatibility test coverage to catch divergence earlier and give operators confidence when substituting youki for runc.

Roadmap Item 2: VM-Based Containers via libkrun

▶ Watch (4:25)

libkrun is a KVM library distributed as a shared library. It enables lightweight VM-based container execution where containers run inside a guest OS within a VM. That model provides stronger isolation than the standard host kernel sharing model. crun already supports this approach experimentally, giving youki a reference point. The plan is to add libkrun support to youki and work out how that execution model integrates with the rest of the youki architecture.

Roadmap Item 3: Simpler Kubernetes Adoption

▶ Watch (5:22)

Adopting youki on Kubernetes today requires several manual steps: install youki on each node, configure containerd or CRI-O to use it, then set a RuntimeClass for per-pod runtime selection. The goal is to eliminate that friction. The planned fix is a deployment tool modeled on kata-deploy for Kata Containers, so the full setup becomes repeatable without manual node configuration. That single change would lower the barrier for clusters wanting to trial youki alongside runc.

Notable Quotes

Yoki is not just an experimental runtime anymore. It is growing as part of the BL cloud native runtime exist. Yusuke Sakurai · ▶ 00:56

today adopting Yoki on Kubernetes still requires several other manual steps Yusuke Sakurai · ▶ 05:26

Key Takeaways

  • youki joined the CNCF sandbox in October 2024 with 7,300 GitHub stars.
  • Net device and memory policy support targets AI and NUMA workloads specifically.
  • A kata-deploy-style tool will make youki adoption on Kubernetes repeatable.

About the Speaker(s)

Yusuke Sakurai is a software engineer at 3-shake Inc. and a reviewer of CNCF youki.