internal/storage/image.go:114// ImageServer wraps up various CRI-related activities into a reusable// implementation.type ImageServer interface {	// ListImages returns list of all images which match the filter.	ListImages(systemContext *types.SystemContext, filter string) ([]ImageResult, error)	// ImageStatus returns status of an image which matches the filter.	ImageStatus(systemContext *types.SystemContext, filter string) (*ImageResult, error)	// PrepareImage returns an Image where the config digest can be grabbed	// for further analysis. Call Close() on the resulting image.	PrepareImage(systemContext *types.SystemContext, imageName string) (types.ImageCloser, error)	// PullImage imports an image from the specified location.	PullImage(systemContext *types.SystemContext, imageName string, options *ImageCopyOptions) (types.ImageReference, error)	// UntagImage removes a name from the specified image, and if it was	// the only name the image had, removes the image.	UntagImage(systemContext *types.SystemContext, imageName string) error	// GetStore returns the reference to the storage library Store which	// the image server uses to hold images, and is the destination used	// when it's asked to pull an image.	GetStore() storage.Store	// ResolveNames takes an image reference and if it's unqualified (w/o hostname),	// it uses crio's default registries to qualify it.	ResolveNames(systemContext *types.SystemContext, imageName string) ([]string, error)}

runtime service提供了管理container的功能，实现了下面的接口：internal/storage/runtime.go:59// RuntimeServer wraps up various CRI-related activities into a reusable// implementation.type RuntimeServer interface {	// CreatePodSandbox creates a pod infrastructure container, using the	// specified PodID for the infrastructure container's ID.  In the CRI	// view of things, a sandbox is distinct from its containers, including	// its infrastructure container, but at this level the sandbox is	// essentially the same as its infrastructure container, with a	// container's membership in a pod being signified by it listing the	// same pod ID in its metadata that the pod's other members do, and	// with the pod's infrastructure container having the same value for	// both its pod's ID and its container ID.	// Pointer arguments can be nil.  Either the image name or ID can be	// omitted, but not both.  All other arguments are required.	CreatePodSandbox(systemContext *types.SystemContext, podName, podID, imageName, imageAuthFile, imageID, containerName, metadataName, uid, namespace string, attempt uint32, idMappingsOptions *storage.IDMappingOptions, labelOptions []string, privileged bool) (ContainerInfo, error)	// RemovePodSandbox deletes a pod sandbox's infrastructure container.	// The CRI expects that a sandbox can't be removed unless its only	// container is its infrastructure container, but we don't enforce that	// here, since we're just keeping track of it for higher level APIs.	RemovePodSandbox(idOrName string) error
	// GetContainerMetadata returns the metadata we've stored for a container.	GetContainerMetadata(idOrName string) (RuntimeContainerMetadata, error)	// SetContainerMetadata updates the metadata we've stored for a container.	SetContainerMetadata(idOrName string, metadata *RuntimeContainerMetadata) error
	// CreateContainer creates a container with the specified ID.	// Pointer arguments can be nil.  Either the image name or ID can be	// omitted, but not both.  All other arguments are required.	CreateContainer(systemContext *types.SystemContext, podName, podID, imageName, imageID, containerName, containerID, metadataName string, attempt uint32, idMappingsOptions *storage.IDMappingOptions, labelOptions []string, privileged bool) (ContainerInfo, error)	// DeleteContainer deletes a container, unmounting it first if need be.	DeleteContainer(idOrName string) error
	// StartContainer makes sure a container's filesystem is mounted, and	// returns the location of its root filesystem, which is not guaranteed	// by lower-level drivers to never change.	StartContainer(idOrName string) (string, error)	// StopContainer attempts to unmount a container's root filesystem,	// freeing up any kernel resources which may be limited.	StopContainer(idOrName string) error
	// GetWorkDir returns the path of a nonvolatile directory on the	// filesystem (somewhere under the Store's Root directory) which can be	// used to store arbitrary data that is specific to the container.  It	// will be removed automatically when the container is deleted.	GetWorkDir(id string) (string, error)	// GetRunDir returns the path of a volatile directory (does not survive	// the host rebooting, somewhere under the Store's RunRoot directory)	// on the filesystem which can be used to store arbitrary data that is	// specific to the container.  It will be removed automatically when	// the container is deleted.	GetRunDir(id string) (string, error)}

# Cgroup management implementation used for the runtime.cgroup_manager = "systemd"
# Specify whether the image pull must be performed in a separate cgroup.separate_pull_cgroup = ""
# infra_ctr_cpuset determines what CPUs will be used to run infra containers.# You can use linux CPU list format to specify desired CPUs.# To get better isolation for guaranteed pods, set this parameter to be equal to kubelet reserved-cpus.infra_ctr_cpuset = ""

internal/config/cgmgr/cgmgr.go:80// SetCgroupManager takes a string and branches on it to return// the type of cgroup manager configuredfunc SetCgroupManager(cgroupManager string) (CgroupManager, error) {	switch cgroupManager {	case systemdCgroupManager:		systemdMgr := SystemdManager{			memoryPath:    cgroupMemoryPathV1,			memoryMaxFile: cgroupMemoryMaxFileV1,		}		if node.CgroupIsV2() {			systemdMgr.memoryPath = cgroupMemoryPathV2			systemdMgr.memoryMaxFile = cgroupMemoryMaxFileV2		}		return &systemdMgr, nil	case cgroupfsCgroupManager:		cgroupfsMgr := CgroupfsManager{			memoryPath:    cgroupMemoryPathV1,			memoryMaxFile: cgroupMemoryMaxFileV1,		}		if node.CgroupIsV2() {			cgroupfsMgr.memoryPath = cgroupMemoryPathV2			cgroupfsMgr.memoryMaxFile = cgroupMemoryMaxFileV2		}		return &cgroupfsMgr, nil	default:		return nil, errors.Errorf("invalid cgroup manager: %s", cgroupManager)	}}

// pullImage performs the actual pull operation of PullImage. Used to separate// the pull implementation from the pullCache logic in PullImage and improve// readability and maintainability.func (s *Server) pullImage(ctx context.Context, pullArgs *pullArguments) (string, error) {  ...      cgroup := ""
		if s.config.SeparatePullCgroup != "" {			if !s.config.CgroupManager().IsSystemd() {				return "", errors.New("--separate-pull-cgroup is supported only with systemd")			}			if s.config.SeparatePullCgroup == "pod" {				cgroup = pullArgs.sandboxCgroup			} else {				cgroup = s.config.SeparatePullCgroup				if !strings.Contains(cgroup, ".slice") {					return "", fmt.Errorf("invalid systemd cgroup %q", cgroup)				}			}		}      ...    }

server/sandbox_run_linux.go:288func (s *Server) runPodSandbox(ctx context.Context, req *types.RunPodSandboxRequest) (resp *types.RunPodSandboxResponse, retErr error) {...// When infra-ctr-cpuset specified, set the infra container CPU set	if s.config.InfraCtrCPUSet != "" {		log.Debugf(ctx, "Set the infra container cpuset to %q", s.config.InfraCtrCPUSet)		g.SetLinuxResourcesCPUCpus(s.config.InfraCtrCPUSet)	} ...}

server/cri/types/types.go:9  NamespaceModePOD       NamespaceMode = 0	NamespaceModeCONTAINER NamespaceMode = 1	NamespaceModeNODE      NamespaceMode = 2	NamespaceModeTARGET    NamespaceMode = 3
server/sandbox_run_linux.go:1003// configureGeneratorForSandboxNamespaces set the linux namespaces for the generator, based on whether the pod is sharing namespaces with the host,// as well as whether CRI-O should be managing the namespace lifecycle.// it returns a slice of cleanup funcs, all of which are the respective NamespaceRemove() for the sandbox.// The caller should defer the cleanup funcs if there is an error, to make sure each namespace we are managing is properly cleaned up.func (s *Server) configureGeneratorForSandboxNamespaces(hostNetwork, hostIPC, hostPID bool, idMappings *idtools.IDMappings, sysctls map[string]string, sb *libsandbox.Sandbox, g *generate.Generator) (cleanupFuncs []func() error, retErr error) {	// Since we need a process to hold open the PID namespace, CRI-O can't manage the NS lifecycle	if hostPID {		if err := g.RemoveLinuxNamespace(string(spec.PIDNamespace)); err != nil {			return nil, err		}	}	namespaceConfig := &nsmgr.PodNamespacesConfig{		Sysctls:    sysctls,		IDMappings: idMappings,		Namespaces: []*nsmgr.PodNamespaceConfig{			{				Type: nsmgr.IPCNS,				Host: hostIPC,			},			{				Type: nsmgr.NETNS,				Host: hostNetwork,			},			{				Type: nsmgr.UTSNS, // there is no option for host UTSNS			},		},	}	if idMappings != nil {		namespaceConfig.Namespaces = append(namespaceConfig.Namespaces, &nsmgr.PodNamespaceConfig{			Type: nsmgr.USERNS,		})	}
	// now that we've configured the namespaces we're sharing, create them    namespaces, err := s.config.NamespaceManager().NewPodNamespaces(namespaceConfig)	if err != nil {		return nil, err	}
	sb.AddManagedNamespaces(namespaces)
	cleanupFuncs = append(cleanupFuncs, sb.RemoveManagedNamespaces)
	if err := configureGeneratorGivenNamespacePaths(sb.NamespacePaths(), g); err != nil {		return cleanupFuncs, err	}
	return cleanupFuncs, nil}

vendor/github.com/cri-o/ocicni/pkg/ocicni/types.go:118// CNIPlugin is the interface that needs to be implemented by a plugintype CNIPlugin interface {   // Name returns the plugin's name. This will be used when searching   // for a plugin by name, e.g.   Name() string
   // GetDefaultNetworkName returns the name of the plugin's default   // network.   GetDefaultNetworkName() string
   // SetUpPod is the method called after the sandbox container of   // the pod has been created but before the other containers of the   // pod are launched.   SetUpPod(network PodNetwork) ([]NetResult, error)
   // SetUpPodWithContext is the same as SetUpPod but takes a context   SetUpPodWithContext(ctx context.Context, network PodNetwork) ([]NetResult, error)
   // TearDownPod is the method called before a pod's sandbox container will be deleted   TearDownPod(network PodNetwork) error
   // TearDownPodWithContext is the same as TearDownPod but takes a context   TearDownPodWithContext(ctx context.Context, network PodNetwork) error
   // GetPodNetworkStatus is the method called to obtain the ipv4 or ipv6 addresses of the pod sandbox   GetPodNetworkStatus(network PodNetwork) ([]NetResult, error)
   // GetPodNetworkStatusWithContext is the same as GetPodNetworkStatus but takes a context   GetPodNetworkStatusWithContext(ctx context.Context, network PodNetwork) ([]NetResult, error)
   // NetworkStatus returns error if the network plugin is in error state   Status() error
   // Shutdown terminates all driver operations   Shutdown() error}

internal/hostport/hostport_manager.go:76func (hm *hostportManager) Add(id string, podPortMapping *PodPortMapping, natInterfaceName string) (err error) {    ...    // try to open hostports    ports, err := hm.openHostports(podPortMapping)    if err != nil {       return err    }    ...}