containerd Alternatives for Kubernetes Nodes and Linux Hosts

containerd is the container runtime daemon that pulls images, manages storage and starts containers for Docker, managed Kubernetes services such as GKE and EKS, and Firecracker. It became a CNCF graduated project on February 28, 2019, and it is under active development. The project's release table lists 2.3 as the LTS branch until April 30, 2028, 2.4 as the current feature branch since September 16, 2026, and 1.7 as end of life since September 30, 2026.

That 1.7 cut-off is why many people are looking right now. Moving to 2.x is one option; another is to rethink the runtime. Few tools are a straight swap, though. Some replace containerd on a Kubernetes node, some sit above it with a friendlier CLI, and some plug in below it to isolate untrusted code. Each pick below says which of those it is.

Prices below are as of November 8, 2026. Our method is on How we review tools.

Quick comparison

CRI-O

CRI-O does one job: it implements the Kubernetes Container Runtime Interface so the kubelet can run pods with any OCI runtime. runc is the default, and Kata Containers is supported out of the box. Like containerd, it is a CNCF graduated project.

The release model is the main difference. CRI-O minor versions follow Kubernetes minor versions, so CRI-O 1.37 pairs with Kubernetes 1.37. Version 1.37.0 was tagged on September 15, 2026, and v1.37.3 and v1.36.8 followed on November 3, 2026. containerd, by contrast, supports several Kubernetes versions per branch and serves Docker and other clients as well.

Best for: Cluster operators who want a runtime that does nothing beyond Kubernetes and upgrades in step with it.

Pricing:

• Free and open source, Apache 2.0
• Commercial support comes through OpenShift or other Kubernetes distributions

Watch out for:

• It is not a general container tool. The CRI-O README puts building, signing and pushing images, and a user-facing CLI, out of scope; you debug nodes with crictl and build elsewhere.
• Every Kubernetes minor upgrade means a CRI-O minor upgrade too, and only bug fixes are backported to older release branches.

Official site: CRI-O.

Docker Engine

Plenty of searches for containerd alternatives come from people who installed containerd with nerdctl and miss the docker CLI. Docker Engine gives it back, along with Compose, BuildKit builds and the daemon socket that CI tools expect. Version 29.9.3 came out on November 3, 2026, per the Engine release notes, and 29.9.1 moved its bundled containerd to 2.4.2 for security fixes.

Underneath, containerd stays. Since Engine 29.0, fresh installs use the containerd image store by default, while upgraded hosts keep the old overlay2 driver until you set containerd-snapshotter in daemon.json. Engine is open source and free on Linux; only Docker Desktop on laptops carries a licence fee.

Best for: Build servers and single hosts where people, scripts and CI images expect docker commands and Compose files.

Pricing:

• Docker Engine on Linux: free, open source through Moby
• Docker Desktop Personal: $0
• Pro: $9 a month billed yearly, $11 billed monthly
• Team: $15 per user a month billed yearly
• Business: $24 per user a month billed yearly

Watch out for:

• Docker Desktop is free only for personal use, non-commercial open source and companies under 250 employees and US $10 million in revenue, per Docker's pricing FAQ.
• dockerd runs as root by default, so you add a second privileged daemon on top of containerd rather than removing one.

Official site: Docker Engine.

Podman

If the goal is to get rid of a long-running daemon, Podman is the honest answer. It has no central service at all: each container runs under a small conmon process, rootless by default, and Quadlet files turn containers into systemd units that start at boot. The Podman releases page lists v6.1.4 from October 12, 2026, which also moved to Buildah 1.45.2.

Podman does not use containerd. It shares its image and storage libraries with Buildah, the image builder from the same project, and our Buildah alternatives page covers that side. For a wider comparison with Docker, Colima and OrbStack, see our Podman alternatives list.

Best for: Fedora, RHEL and other systemd hosts that run services as containers and want no root daemon.

Pricing:

• Free, Apache 2.0
• Podman Desktop is also free

Watch out for:

• Podman is not a Kubernetes node runtime. The same community's answer for kubelets is CRI-O, so a cluster still needs containerd or CRI-O.
• On macOS and Windows it runs containers inside a Linux VM managed by podman machine, which adds start-up time and file-sharing overhead.

Official site: Podman.

Incus (or LXD)

Some containerd users really want machines, not processes. Incus runs system containers that boot a full Linux init, plus real KVM virtual machines and OCI application containers, all from one CLI and REST API, per the Incus project page. It is the community fork of LXD, led by many of LXD's original developers and licensed Apache 2.0 with no CLA.

Incus 7.0 LTS came out in May 2026 with support until June 2031, and monthly releases reached 7.6.0 at the end of October 2026. Canonical's LXD is still maintained too, under AGPLv3 since December 2023, with 6.10.1 shipping in late October 2026 for the new LXD 6 LTS series.

Best for: Homelabs and hosting setups that want long-lived Linux environments and VMs instead of single-process containers.

Pricing:

• Incus: free, Apache 2.0
• LXD: free, AGPLv3; commercial support through Ubuntu Pro

Watch out for:

• Incus upstream ships no packages, so you install it from your distribution or a third-party repository and versions differ between distros.
• It is not a Kubernetes runtime. Use it next to a cluster for VMs and system containers, not as a CRI replacement.

Official site: Incus (or LXD).

Kata Containers

Kata Containers wraps each pod in a lightweight virtual machine, so a kernel exploit inside the container hits the guest kernel rather than the host. It is an OCI runtime with a shim for containerd and CRI-O, and it supports QEMU, Cloud Hypervisor and Firecracker as hypervisors. The OpenInfra Foundation supports the project, and the code is Apache 2.0.

The 4.x series is a big change. Version 4.0.0 from July 20, 2026 made the Rust runtime the default and deprecated the Go runtime, and 4.2.0 followed on September 15, 2026 with an Ubuntu 26.04 guest rootfs, per the Kata releases page. The newest release is 4.3.1, from October 21, 2026, a day after 4.3.0. The 3.32.0 release already moved its tests to containerd 2.3.

Best for: Multi-tenant clusters that need VM-level isolation per pod but want to keep Kubernetes tooling.

Pricing:

• Free and open source, Apache 2.0

Watch out for:

• The 4.0.0 notes say GPU support on Cloud Hypervisor and Dragonball is not tested in upstream CI, so GPU pods need your own testing.
• Setups built on the old Go runtime now get only critical and CVE fixes and should move to runtime-rs.

Official site: Kata Containers.

gVisor

Google's gVisor takes a different route to isolation. Instead of a VM, it puts an application kernel written in Go between the container and the host, so most system calls are handled in user space. Its OCI runtime, runsc, has quick starts for Docker, containerd, CRI-O and Kubernetes in the gVisor docs.

It needs no hardware virtualization, which helps on cloud VMs where nested KVM is unavailable. The repository is Apache 2.0 with about 19.3k stars, and it supports x86_64 and ARM64.

Best for: Running untrusted or customer-supplied code in containers when VMs per pod are too heavy.

Pricing:

• Free and open source, Apache 2.0

Watch out for:

• The docs warn of poor performance for system-call-heavy workloads, because every call goes through the gVisor kernel.
• Not every system call, /proc file or /sys file is implemented, so some applications fail and need testing first.

Official site: gVisor.

How to choose

When to stay with containerd

Stay on containerd if you run managed Kubernetes or a mixed fleet where Docker hosts and kubelets share one runtime. If you are on 1.7, the low-risk move is the 2.3 LTS branch, which the release table supports until April 30, 2028 and marks compatible with Kubernetes 1.36 and 1.37. Kata Containers and gVisor both run under containerd, so stronger isolation does not require leaving it.

Frequently asked questions