● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
C

containerd (Wasm)

Wasm
Open source · Apache-2.0

containerd is a container runtime — the thing that sits between Kubernetes (via CRI) and the OS, pulling images, managing snapshots, and starting/stopping containers via runc or other low-level runtimes. It's not a Wasm runtime itself.

updated 2026-07-01

What it is

containerd is a container runtime — the thing that sits between Kubernetes (via CRI) and the OS, pulling images, managing snapshots, and starting/stopping containers via runc or other low-level runtimes. It's not a Wasm runtime itself. Its relevance to Wasm comes from its shim v2 API, which lets you swap out the default OCI/runc execution path for alternative runtimes — including Wasm runtimes like WasmEdge, wasmtime, and Spin — via the runwasi project and related shims. So "containerd (Wasm)" really means: containerd as the control-plane substrate that makes running Wasm workloads alongside regular containers in Kubernetes possible, without needing a separate scheduler or CRI implementation.

If you're expecting a standalone Wasm sandbox, this isn't it. It's infrastructure plumbing that makes Wasm a first-class citizen next to your existing container workloads.

Who builds it and why

containerd is a CNCF graduated project (long-standing, one of the most depended-upon pieces of cloud-native infra — it's the default runtime shim for both Docker and most managed Kubernetes offerings). The core maintainer base includes engineers from Docker, Microsoft, AWS, and Google, among others. Wasm support specifically is driven by the runwasi sub-project (Microsoft, Second State/WasmEdge, and community contributors), which lives under the containerd GitHub org but has its own smaller contributor circle. The motivation is straightforward: enterprises want to run Wasm modules as an alternative to full containers for edge, plugin, or lightweight-compute use cases, without re-architecting their existing Kubernetes/containerd-based fleets.

Production readiness signal

containerd core is about as production-proven as infrastructure gets — 20,908 GitHub stars, 796 contributors, active commits through mid-2026, and a stable v2.3.2 release line. That's a mature, battle-tested project running in nearly every Kubernetes cluster on earth.

The Wasm-specific shim layer is a different story and much younger — it doesn't carry the same track record as containerd's OCI runtime path. CNCF maturity level for the Wasm shim components specifically is not publicly available, and adoption data for Wasm-on-containerd in production is thin compared to standard container workloads. Treat the core runtime as rock-solid and the Wasm execution path as early-adopter territory.

Who should use this

  • Platform teams already standardized on containerd/Kubernetes who want to pilot Wasm workloads (edge functions, plugins, sandboxed extensions) without introducing a second runtime stack.
  • Teams building multi-tenant plugin systems where Wasm's sandboxing and fast cold-start beat spinning up full containers.
  • Organizations experimenting with WasmEdge, Spin, or wasmtime workloads inside existing Kubernetes clusters.

Who should NOT use this

  • Anyone needing a production-hardened, widely-adopted Wasm-in-Kubernetes story today — the shim ecosystem is still maturing and documentation/tooling gaps are common.
  • Teams without existing containerd/Kubernetes expertise — this is not a beginner-friendly path into Wasm; you need to understand shim v2 internals and CRI configuration.
  • Anyone wanting a pure Wasm runtime for standalone (non-Kubernetes) use — look directly at wasmtime, WasmEdge, or Wasmer instead.
  • Workloads requiring GPU access, complex syscalls, or full POSIX compatibility — Wasm's sandboxed model is intentionally restrictive.

Alternatives

  • WasmEdge / Spin standalone — run Wasm modules directly without going through containerd's shim layer if you don't need Kubernetes integration.
  • Krustlet — a Kubernetes kubelet implementation written in Rust specifically for running Wasm workloads, bypassing containerd entirely.
  • Standard containerd + runc — if Wasm's operational immaturity isn't worth the tradeoff yet, stick with normal OCI containers.

Pricing

Fully open source, Apache-2.0 licensed. No paid tier, no vendor lock-in — cost is entirely your own engineering and operational time to integrate and maintain the Wasm shim path.

Frequently asked

What is containerd (Wasm)?+
containerd is a container runtime — the thing that sits between Kubernetes (via CRI) and the OS, pulling images, managing snapshots, and starting/stopping containers via runc or other low-level runtimes. It's not a Wasm runtime itself.
Who builds containerd (Wasm)?+
containerd is a CNCF graduated project (long-standing, one of the most depended-upon pieces of cloud-native infra — it's the default runtime shim for both Docker and most managed Kubernetes offerings). The core maintainer base includes engineers from Docker, Microsoft, AWS, and Google, among others.
Is containerd (Wasm) production ready?+
containerd core is about as production-proven as infrastructure gets — 20,908 GitHub stars, 796 contributors, active commits through mid-2026, and a stable v2.3.2 release line. That's a mature, battle-tested project running in nearly every Kubernetes cluster on earth.
Who should use containerd (Wasm)?+
Platform teams already standardized on containerd/Kubernetes who want to pilot Wasm workloads (edge functions, plugins, sandboxed extensions) without introducing a second runtime stack. Teams building multi-tenant plugin systems where Wasm's sandboxing and fast cold-start beat spinning up full containers.
Who should not use containerd (Wasm)?+
Anyone needing a production-hardened, widely-adopted Wasm-in-Kubernetes story today — the shim ecosystem is still maturing and documentation/tooling gaps are common.
What are the alternatives to containerd (Wasm)?+
WasmEdge / Spin standalone — run Wasm modules directly without going through containerd's shim layer if you don't need Kubernetes integration. Krustlet — a Kubernetes kubelet implementation written in Rust specifically for running Wasm workloads, bypassing containerd entirely.
How much does containerd (Wasm) cost?+
Fully open source, Apache-2.0 licensed. No paid tier, no vendor lock-in — cost is entirely your own engineering and operational time to integrate and maintain the Wasm shim path.