A containerd-shim is a helper process between containerd’s runtime and a running container. It keeps the container alive after the parent runtime exits, redirects logs, and manages lifecycle events such as pausing and restarting. section 7.2
The container execution path separates orchestration, runtime startup, and ongoing container management:
- Docker Engine uses runC to spawn the container process. section 7.2
- runC hands control to containerd-shim once the container is running. section 7.2
- containerd coordinates shims, the host system, and external resources. section 7.2
- For Wasm, a specialized shim such as containerd-shim-wasm connects containerd to a Wasm runtime such as Wasmtime; io.containerd.spin.v2 supports Spin applications. section 7.2 section 7.5
Run a Wasm container through a shim
sudo ctr run --rm --runtime io.containerd.wasmtime.v1 --platform wasi/wasm32 docker.io/library/hello-wasm-container:latest hello-wasm-instance section 7.5
Figure 7.4 A closer look inside the Docker engine when executing a Wasm module, showing the key components, including containerd-shim-wasm and the Wasm runtime
Use the architecture diagram to compare ordinary container execution with the Wasm path, where containerd-shim-wasm connects containerd to a Wasm runtime. section 7.2
