<p>The process ID 21186 is runc. And 21257 is kube-controller-manager.</p>

<p>I can't understand why host's process is child process.</p>

<p>And, I didn't know docker container can run host's process.</p>

<p>Why k8s takes that architecture.</p>

<p>Other processes are same form.</p>

<p>Can you help please? Thank you</p>

<pre><code>[root@instance-3 ~]# ps -ef | grep 21186
root     21186 10930  0 06:20 ?        00:00:00 containerd-shim -namespace moby -workdir /var/lib/containerd/io.containerd.runtime.v1.linux/moby/3fd66799d02cb2c2f195fd85fadf852b7a7c0905707e6c25d1fdec93c1dc850b -address /run/containerd/containerd.sock -containerd-binary /usr/bin/containerd -runtime-root /var/run/docker/runtime-runc
root     21257 21186  1 06:20 ?        00:00:08 kube-controller-manager --aut....
</code></pre>

user1371662
<p>This is how <a href="https://containerd.io" rel="nofollow noreferrer">containerd</a> an <a href="https://www.opencontainers.org" rel="nofollow noreferrer">OCI</a> compliant core container runtime works in kubernetes.</p>

<p><a href="https://i.stack.imgur.com/aKXIR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/aKXIR.png" alt="enter image description here"></a></p>

<ol>
<li><p>Kubelet calls cri-containerd, via the CRI runtime service API, to create a pod;</p></li>
<li><p>cri-containerd uses containerd to create and start a special pause container (the sandbox container) and put that container inside the pod’s cgroups and namespace (steps omitted for brevity);</p></li>
<li><p>cri-containerd configures the pod’s network namespace using CNI;</p></li>
<li><p>Kubelet subsequently calls cri-containerd, via the CRI image service API, to pull the application container image;</p></li>
<li><p>cri-containerd further uses containerd to pull the image if the image is not present on the node;</p></li>
<li><p>Kubelet then calls cri-containerd, via the CRI runtime service API, to create and start the application container inside the pod using the pulled container image;</p></li>
<li><p>cri-containerd finally calls containerd to create the application container, put it inside the pod’s cgroups and namespace, then to start the pod’s new application container. After these steps, a pod and its corresponding application container is created and running.</p></li>
</ol>

<p><a href="https://kubernetes.io/blog/2017/11/containerd-container-runtime-options-kubernetes/" rel="nofollow noreferrer">https://kubernetes.io/blog/2017/11/containerd-container-runtime-options-kubernetes/</a></p>
