Proposal for client-server container runtime

docs/proposals/runtime-client-server.md

+<!-- BEGIN MUNGE: UNVERSIONED_WARNING -->
+
+<!-- BEGIN STRIP_FOR_RELEASE -->
+
+<img src="http://kubernetes.io/img/warning.png" alt="WARNING"
+     width="25" height="25">
+<img src="http://kubernetes.io/img/warning.png" alt="WARNING"
+     width="25" height="25">
+<img src="http://kubernetes.io/img/warning.png" alt="WARNING"
+     width="25" height="25">
+<img src="http://kubernetes.io/img/warning.png" alt="WARNING"
+     width="25" height="25">
+<img src="http://kubernetes.io/img/warning.png" alt="WARNING"
+     width="25" height="25">
+
+<h2>PLEASE NOTE: This document applies to the HEAD of the source tree</h2>
+
+If you are using a released version of Kubernetes, you should
+refer to the docs that go with that version.
+
+Documentation for other releases can be found at
+[releases.k8s.io](http://releases.k8s.io).
+</strong>
+--
+
+<!-- END STRIP_FOR_RELEASE -->
+
+<!-- END MUNGE: UNVERSIONED_WARNING -->
+
+# Client/Server container runtime
+
+## Abstract
+
+A proposal of client/server implementation of kubelet container runtime interface.
+
+## Motivation
+
+Currently, any container runtime has to be linked into the kubelet. This makes
+experimentation difficult, and prevents users from landing an alternate
+container runtime without landing code in core kubernetes.
+
+To facilitate experimentation and to enable user choice, this proposal adds a
+client/server implementation of the [new container runtime interface](https://github.com/kubernetes/kubernetes/pull/25899). The main goal
+of this proposal is:
+
+- make it easy to integrate new container runtimes
+- improve code maintainability
+
+## Proposed design
+
+**Design of client/server container runtime**
+
+The main idea of client/server container runtime is to keep main control logic in kubelet while letting remote runtime only do dedicated actions. An alpha [container runtime API](../../pkg/kubelet/api/v1alpha1/runtime/api.proto) is introduced for integrating new container runtimes. The API is based on [protobuf](https://developers.google.com/protocol-buffers/) and [gRPC](http://www.grpc.io) for a number of benefits:
+
+- Perform faster than json
+- Get client bindings for free: gRPC supports ten languages
+- No encoding/decoding codes needed
+- Manage api interfaces easily: server and client interfaces are generated automatically
+
+A new container runtime manager `KubeletGenericRuntimeManager` will be introduced to kubelet, which will
+
+- conforms to kubelet's [Runtime](../../pkg/kubelet/container/runtime.go#L58) interface
+- manage Pods and Containers lifecycle according to kubelet policies
+- call remote runtime's API to perform specific pod, container or image operations
+
+A simple workflow of invoking remote runtime API on starting a Pod with two containers can be shown:
+
+```
+Kubelet                  KubeletGenericRuntimeManager       RemoteRuntime
+   +                              +                               +
+   |                              |                               |
+   +---------SyncPod------------->+                               |
+   |                              |                               |
+   |                              +---- Create PodSandbox ------->+
+   |                              +<------------------------------+
+   |                              |                               |
+   |                              XXXXXXXXXXXX                    |
+   |                              |          X                    |
+   |                              |    NetworkPlugin.             |
+   |                              |       SetupPod                |
+   |                              |          X                    |
+   |                              XXXXXXXXXXXX                    |
+   |                              |                               |
+   |                              +<------------------------------+
+   |                              +----    Pull image1   -------->+
+   |                              +<------------------------------+
+   |                              +---- Create container1 ------->+
+   |                              +<------------------------------+
+   |                              +---- Start container1 -------->+
+   |                              +<------------------------------+
+   |                              |                               |
+   |                              +<------------------------------+
+   |                              +----    Pull image2   -------->+
+   |                              +<------------------------------+
+   |                              +---- Create container2 ------->+
+   |                              +<------------------------------+
+   |                              +---- Start container2 -------->+
+   |                              +<------------------------------+
+   |                              |                               |
+   | <-------Success--------------+                               |
+   |                              |                               |
+   +                              +                               +
+```
+
+And deleting a pod can be shown:
+
+```
+Kubelet                  KubeletGenericRuntimeManager      RemoteRuntime
+   +                              +                               +
+   |                              |                               |
+   +---------SyncPod------------->+                               |
+   |                              |                               |
+   |                              +----   Stop container1   ----->+
+   |                              +<------------------------------+
+   |                              +----  Delete container1  ----->+
+   |                              +<------------------------------+
+   |                              |                               |
+   |                              +----   Stop container2   ------>+
+   |                              +<------------------------------+
+   |                              +----  Delete container2  ------>+
+   |                              +<------------------------------+
+   |                              |                               |
+   |                              XXXXXXXXXXXX                    |
+   |                              |          X                    |
+   |                              |    NetworkPlugin.             |
+   |                              |       TeardownPod             |
+   |                              |          X                    |
+   |                              XXXXXXXXXXXX                    |
+   |                              |                               |
+   |                              |                               |
+   |                              +---- Delete PodSandbox  ------>+
+   |                              +<------------------------------+
+   |                              |                               |
+   | <-------Success--------------+                               |
+   |                              |                               |
+   +                              +                               +
+```
+
+**API definition**
+
+Since we are going to introduce more image formats and want to separate image management from containers and pods, this proposal introduces two services `RuntimeService` and `ImageService`. Both services are defined at [pkg/kubelet/api/v1alpha1/runtime/api.proto](../../pkg/kubelet/api/v1alpha1/runtime/api.proto):
+
+```proto
+// Runtime service defines the public APIs for remote container runtimes
+service RuntimeService {
+    // Version returns the runtime name, runtime version and runtime API version
+    rpc Version(VersionRequest) returns (VersionResponse) {}
+
+    // CreatePodSandbox creates a pod-level sandbox.
+    // The definition of PodSandbox is at https://github.com/kubernetes/kubernetes/pull/25899
+    rpc CreatePodSandbox(CreatePodSandboxRequest) returns (CreatePodSandboxResponse) {}
+    // StopPodSandbox stops the sandbox. If there are any running containers in the
+    // sandbox, they should be force terminated.
+    rpc StopPodSandbox(StopPodSandboxRequest) returns (StopPodSandboxResponse) {}
+    // DeletePodSandbox deletes the sandbox. If there are any running containers in the
+    // sandbox, they should be force deleted.
+    rpc DeletePodSandbox(DeletePodSandboxRequest) returns (DeletePodSandboxResponse) {}
+    // PodSandboxStatus returns the Status of the PodSandbox.
+    rpc PodSandboxStatus(PodSandboxStatusRequest) returns (PodSandboxStatusResponse) {}
+    // ListPodSandbox returns a list of SandBox.
+    rpc ListPodSandbox(ListPodSandboxRequest) returns (ListPodSandboxResponse) {}
+
+    // CreateContainer creates a new container in specified PodSandbox
+    rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
+    // StartContainer starts the container.
+    rpc StartContainer(StartContainerRequest) returns (StartContainerResponse) {}
+    // StopContainer stops a running container with a grace period (i.e., timeout).
+    rpc StopContainer(StopContainerRequest) returns (StopContainerResponse) {}
+    // RemoveContainer removes the container. If the container is running, the container
+    // should be force removed.
+    rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse) {}
+    // ListContainers lists all containers by filters.
+    rpc ListContainers(ListContainersRequest) returns (ListContainersResponse) {}
+    // ContainerStatus returns status of the container.
+    rpc ContainerStatus(ContainerStatusRequest) returns (ContainerStatusResponse) {}
+
+    // Exec executes the command in the container.
+    rpc Exec(stream ExecRequest) returns (stream ExecResponse) {}
+}
+
+// Image service defines the public APIs for managing images
+service ImageService {
+    // ListImages lists existing images.
+    rpc ListImages(ListImagesRequest) returns (ListImagesResponse) {}
+    // ImageStatus returns the status of the image.
+    rpc ImageStatus(ImageStatusRequest) returns (ImageStatusResponse) {}
+    // PullImage pulls a image with authentication config.
+    rpc PullImage(PullImageRequest) returns (PullImageResponse) {}
+    // RemoveImage removes the image.
+    rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse) {}
+}
+```
+
+Note that some types in [pkg/kubelet/api/v1alpha1/runtime/api.proto](../../pkg/kubelet/api/v1alpha1/runtime/api.proto) are already defined at [Container runtime interface/integration](https://github.com/kubernetes/kubernetes/pull/25899).
+We should decide how to integrate the types in [#25899](https://github.com/kubernetes/kubernetes/pull/25899) with gRPC services:
+
+* Auto-generate those types into protobuf by [go2idl](../../cmd/libs/go2idl/)
+  - Pros:
+    - trace type changes automatically, all type changes in Go will be automatically generated into proto files
+  - Cons:
+    - type change may break existing API implementations, e.g. new fields added automatically may not noticed by remote runtime
+    - needs to convert Go types to gRPC generated types, and vise versa
+    - needs processing attributes order carefully so as not to break generated protobufs (this could be done by using [protobuf tag](https://developers.google.com/protocol-buffers/docs/gotutorial))
+    - go2idl doesn't support gRPC, [protoc-gen-gogo](https://github.com/gogo/protobuf) is still required for generating gRPC client
+* Embed those types as raw protobuf definitions and generate Go files by [protoc-gen-gogo](https://github.com/gogo/protobuf)
+  - Pros:
+    - decouple type definitions, all type changes in Go will be added to proto manually, so it's easier to track gRPC API version changes
+    - Kubelet could reuse Go types generated by `protoc-gen-gogo` to avoid type conversions
+  - Cons:
+    - duplicate definition of same types
+    - hard to track type changes automatically
+    - need to manage proto files manually
+
+For better version controlling and fast iterations, this proposal embeds all those types in `api.proto` directly.
+
+## Implementation
+
+Each new runtime should implement the [gRPC](http://www.grpc.io) server based on [pkg/kubelet/api/v1alpha1/runtime/api.proto](../../pkg/kubelet/api/v1alpha1/runtime/api.proto). For version controlling, `KubeletGenericRuntimeManager` will request `RemoteRuntime`'s `Version()` interface with the runtime api version. To keep backward compatibility, the API follows standard [protobuf guide](https://developers.google.com/protocol-buffers/docs/proto) to deprecate or add new interfaces.
+
+A new flag `--container-runtime-endpoint` (overrides `--container-runtime`) will be introduced to kubelet which identifies the unix socket file of the remote runtime service. And new flag `--image-service-endpoint` will be introduced to kubelet which identifies the unix socket file of the image service.
+
+To facilitate switching current container runtime (e.g. `docker` or `rkt`) to new runtime API, `KubeletGenericRuntimeManager` will provide a plugin mechanism allowing to specify local implementation or gRPC implementation.
+
+## Community Discussion
+
+This proposal is first filed by [@brendandburns](https://github.com/brendandburns) at [kubernetes/13768](https://github.com/kubernetes/kubernetes/issues/13768):
+
+* [kubernetes/13768](https://github.com/kubernetes/kubernetes/issues/13768)
+* [kubernetes/13709](https://github.com/kubernetes/kubernetes/pull/13079)
+* [New container runtime interface](https://github.com/kubernetes/kubernetes/pull/25899)
+
+
+<!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
+[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/runtime-client-server.md?pixel)]()
+<!-- END MUNGE: GENERATED_ANALYTICS -->

hack/update-generated-runtime-dockerized.sh

+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_REMOTE_RUNTIME_ROOT="${KUBE_ROOT}/pkg/kubelet/api/v1alpha1/runtime"
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+
+hack/build-go.sh cmd/libs/go2idl/go-to-protobuf/protoc-gen-gogo
+
+if [[ -z "$(which protoc)" || "$(protoc --version)" != "libprotoc 3.0."* ]]; then
+  echo "Generating protobuf requires protoc 3.0.0-beta1 or newer. Please download and"
+  echo "install the platform appropriate Protobuf package for your OS: "
+  echo
+  echo "  https://github.com/google/protobuf/releases"
+  echo
+  echo "WARNING: Protobuf changes are not being validated"
+  exit 1
+fi
+
+function cleanup {
+	rm -f ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go.bak
+}
+
+trap cleanup EXIT
+
+gogopath=$(dirname $(kube::util::find-binary "protoc-gen-gogo"))
+export PATH=$gogopath:$PATH
+protoc -I${KUBE_REMOTE_RUNTIME_ROOT} --gogo_out=plugins=grpc:${KUBE_REMOTE_RUNTIME_ROOT} ${KUBE_REMOTE_RUNTIME_ROOT}/api.proto
+echo "$(cat hack/boilerplate/boilerplate.go.txt ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go)" > ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go
+sed -i".bak" "s/Copyright YEAR/Copyright $(date '+%Y')/g" ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go
+

hack/update-generated-runtime.sh

+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+source "${KUBE_ROOT}/build/common.sh"
+
+kube::golang::setup_env
+
+function prereqs() {
+  kube::log::status "Verifying Prerequisites...."
+  kube::build::ensure_docker_in_path || return 1
+  if kube::build::is_osx; then
+      kube::build::docker_available_on_osx || return 1
+  fi
+  kube::build::ensure_docker_daemon_connectivity || return 1
+
+  KUBE_ROOT_HASH=$(kube::build::short_hash "${HOSTNAME:-}:${REPO_DIR:-${KUBE_ROOT}}/go-to-protobuf")
+  KUBE_BUILD_IMAGE_TAG="build-${KUBE_ROOT_HASH}"
+  KUBE_BUILD_IMAGE="${KUBE_BUILD_IMAGE_REPO}:${KUBE_BUILD_IMAGE_TAG}"
+  KUBE_BUILD_CONTAINER_NAME="kube-build-${KUBE_ROOT_HASH}"
+  KUBE_BUILD_DATA_CONTAINER_NAME="kube-build-data-${KUBE_ROOT_HASH}"
+  DOCKER_MOUNT_ARGS=(
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/cluster:/go/src/${KUBE_GO_PACKAGE}/cluster"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/cmd:/go/src/${KUBE_GO_PACKAGE}/cmd"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/vendor:/go/src/${KUBE_GO_PACKAGE}/vendor"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/hack:/go/src/${KUBE_GO_PACKAGE}/hack"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/pkg:/go/src/${KUBE_GO_PACKAGE}/pkg"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/federation:/go/src/${KUBE_GO_PACKAGE}/federation"
+    --volume "${REPO_DIR:-${KUBE_ROOT}}/third_party:/go/src/${KUBE_GO_PACKAGE}/third_party"
+    --volume /etc/localtime:/etc/localtime:ro
+    --volumes-from "${KUBE_BUILD_DATA_CONTAINER_NAME}"
+  )
+  LOCAL_OUTPUT_BUILD_CONTEXT="${LOCAL_OUTPUT_IMAGE_STAGING}/${KUBE_BUILD_IMAGE}"
+}
+
+prereqs
+mkdir -p "${LOCAL_OUTPUT_BUILD_CONTEXT}"
+cp "${KUBE_ROOT}/cmd/libs/go2idl/go-to-protobuf/build-image/Dockerfile" "${LOCAL_OUTPUT_BUILD_CONTEXT}/Dockerfile"
+kube::build::update_dockerfile
+kube::build::docker_build "${KUBE_BUILD_IMAGE}" "${LOCAL_OUTPUT_BUILD_CONTEXT}" 'false'
+kube::build::run_build_command hack/update-generated-runtime-dockerized.sh "$@"
+

hack/verify-flags/exceptions.txt

@@ -79,6 +79,10 @@ hack/test-update-storage-objects.sh:  local storage_media_type=${2:-""}
 hack/test-update-storage-objects.sh:  local storage_versions=${1:-""}
 hack/test-update-storage-objects.sh:  source_file=${test_data[0]}
 hack/test-update-storage-objects.sh:# source_file,resource,namespace,name,old_version,new_version
+pkg/kubelet/api/v1alpha1/runtime/api.pb.go:	ContainerPort *int32 `protobuf:"varint,3,opt,name=container_port" json:"container_port,omitempty"`
+pkg/kubelet/api/v1alpha1/runtime/api.pb.go:	OomScoreAdj      *int64 `protobuf:"varint,5,opt,name=oom_score_adj" json:"oom_score_adj,omitempty"`
+pkg/kubelet/api/v1alpha1/runtime/api.proto:    optional int32 container_port = 3;
+pkg/kubelet/api/v1alpha1/runtime/api.proto:    optional int64 oom_score_adj = 5;
 pkg/kubelet/network/hairpin/hairpin.go:	hairpinModeRelativePath = "hairpin_mode"
 pkg/kubelet/qos/policy_test.go:			t.Errorf("oom_score_adj should be between %d and %d, but was %d", test.lowOOMScoreAdj, test.highOOMScoreAdj, oomScoreAdj)
 pkg/kubelet/qos/policy_test.go:	highOOMScoreAdj int // The min oom_score_adj score the container should be assigned.

hack/verify-generated-runtime.sh

+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_REMOTE_RUNTIME_ROOT="${KUBE_ROOT}/pkg/kubelet/api/v1alpha1/runtime"
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+
+function cleanup {
+	rm -rf ${KUBE_REMOTE_RUNTIME_ROOT}/_tmp/
+}
+
+trap cleanup EXIT
+
+mkdir -p ${KUBE_REMOTE_RUNTIME_ROOT}/_tmp
+cp ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go ${KUBE_REMOTE_RUNTIME_ROOT}/_tmp/
+
+ret=0
+hack/update-generated-runtime.sh
+diff -I "gzipped FileDescriptorProto" -I "0x" -Naupr ${KUBE_REMOTE_RUNTIME_ROOT}/_tmp/api.pb.go ${KUBE_REMOTE_RUNTIME_ROOT}/api.pb.go || ret=$?
+if [[ $ret -eq 0 ]]; then
+    echo "Generated container runtime api is up to date."
+else
+    echo "Generated container runtime api is out of date. Please run hack/update-generated-runtime.sh"
+    exit 1
+fi

pkg/kubelet/api/v1alpha1/runtime/api.pb.go

+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo.
+// source: api.proto
+// DO NOT EDIT!
+
+/*
+Package runtime is a generated protocol buffer package.
+
+It is generated from these files:
+	api.proto
+
+It has these top-level messages:
+	VersionRequest
+	VersionResponse
+	DNSOption
+	PortMapping
+	Mount
+	ResourceRequirements
+	PodSandboxResources
+	NamespaceOption
+	LinuxPodSandboxConfig
+	PodSandboxConfig
+	CreatePodSandboxRequest
+	CreatePodSandboxResponse
+	StopPodSandboxRequest
+	StopPodSandboxResponse
+	DeletePodSandboxRequest
+	DeletePodSandboxResponse
+	PodSandboxStatusRequest
+	PodSandboxNetworkStatus
+	Namespace
+	LinuxPodSandboxStatus
+	PodSandboxStatus
+	PodSandboxStatusResponse
+	PodSandboxFilter
+	ListPodSandboxRequest
+	PodSandbox
+	ListPodSandboxResponse
+	ImageSpec
+	KeyValue
+	LinuxContainerResources
+	SELinuxOption
+	Capability
+	LinuxContainerConfig
+	ContainerConfig
+	CreateContainerRequest
+	CreateContainerResponse
+	StartContainerRequest
+	StartContainerResponse
+	StopContainerRequest
+	StopContainerResponse
+	RemoveContainerRequest
+	RemoveContainerResponse
+	ContainerFilter
+	ListContainersRequest
+	Container
+	ListContainersResponse
+	ContainerStatusRequest
+	ContainerStatus
+	ContainerStatusResponse
+	ExecRequest
+	ExecResponse
+	ImageFilter
+	ListImagesRequest
+	Image
+	ListImagesResponse
+	ImageStatusRequest
+	ImageStatusResponse
+	AuthConfig
+	PullImageRequest
+	PullImageResponse
+	RemoveImageRequest
+	RemoveImageResponse
+*/
+package runtime
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+type Protocol int32
+
+const (
+	Protocol_TCP Protocol = 0
+	Protocol_UDP Protocol = 1
+)
+
+var Protocol_name = map[int32]string{
+	0: "TCP",
+	1: "UDP",
+}
+var Protocol_value = map[string]int32{
+	"TCP": 0,
+	"UDP": 1,
+}
+
+func (x Protocol) Enum() *Protocol {
+	p := new(Protocol)
+	*p = x
+	return p
+}
+func (x Protocol) String() string {
+	return proto.EnumName(Protocol_name, int32(x))
+}
+func (x *Protocol) UnmarshalJSON(data []byte) error {
+	value, err := proto.UnmarshalJSONEnum(Protocol_value, data, "Protocol")
+	if err != nil {
+		return err
+	}
+	*x = Protocol(value)
+	return nil
+}
+
+type PodSandBoxState int32
+
+const (
+	PodSandBoxState_READY    PodSandBoxState = 0
+	PodSandBoxState_NOTREADY PodSandBoxState = 1
+)
+
+var PodSandBoxState_name = map[int32]string{
+	0: "READY",
+	1: "NOTREADY",
+}
+var PodSandBoxState_value = map[string]int32{
+	"READY":    0,
+	"NOTREADY": 1,
+}
+
+func (x PodSandBoxState) Enum() *PodSandBoxState {
+	p := new(PodSandBoxState)
+	*p = x
+	return p
+}
+func (x PodSandBoxState) String() string {
+	return proto.EnumName(PodSandBoxState_name, int32(x))
+}
+func (x *PodSandBoxState) UnmarshalJSON(data []byte) error {
+	value, err := proto.UnmarshalJSONEnum(PodSandBoxState_value, data, "PodSandBoxState")
+	if err != nil {
+		return err
+	}
+	*x = PodSandBoxState(value)
+	return nil
+}
+
+type ContainerState int32
+
+const (
+	ContainerState_CREATED ContainerState = 0
+	ContainerState_RUNNING ContainerState = 1
+	ContainerState_EXITED  ContainerState = 2
+	ContainerState_UNKNOWN ContainerState = 3
+)
+
+var ContainerState_name = map[int32]string{
+	0: "CREATED",
+	1: "RUNNING",
+	2: "EXITED",
+	3: "UNKNOWN",
+}
+var ContainerState_value = map[string]int32{
+	"CREATED": 0,
+	"RUNNING": 1,
+	"EXITED":  2,
+	"UNKNOWN": 3,
+}
+
+func (x ContainerState) Enum() *ContainerState {
+	p := new(ContainerState)
+	*p = x
+	return p
+}
+func (x ContainerState) String() string {
+	return proto.EnumName(ContainerState_name, int32(x))
+}
+func (x *ContainerState) UnmarshalJSON(data []byte) error {
+	value, err := proto.UnmarshalJSONEnum(ContainerState_value, data, "ContainerState")
+	if err != nil {
+		return err
+	}
+	*x = ContainerState(value)
+	return nil
+}
+
+type VersionRequest struct {
+	// The version of kubelet runtime API.
+	Version          *string `protobuf:"bytes,1,opt,name=version" json:"version,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *VersionRequest) Reset()         { *m = VersionRequest{} }
+func (m *VersionRequest) String() string { return proto.CompactTextString(m) }
+func (*VersionRequest) ProtoMessage()    {}
+
+func (m *VersionRequest) GetVersion() string {
+	if m != nil && m.Version != nil {
+		return *m.Version
+	}
+	return ""
+}
+
+type VersionResponse struct {
+	// The version of the kubelet runtime API.
+	Version *string `protobuf:"bytes,1,opt,name=version" json:"version,omitempty"`
+	// The name of the container runtime.
+	RuntimeName *string `protobuf:"bytes,2,opt,name=runtime_name" json:"runtime_name,omitempty"`
+	// The version of the container runtime.
+	RuntimeVersion *string `protobuf:"bytes,3,opt,name=runtime_version" json:"runtime_version,omitempty"`
+	// The API version of the container runtime.
+	RuntimeApiVersion *string `protobuf:"bytes,4,opt,name=runtime_api_version" json:"runtime_api_version,omitempty"`
+	XXX_unrecognized  []byte  `json:"-"`
+}
+
+func (m *VersionResponse) Reset()         { *m = VersionResponse{} }
+func (m *VersionResponse) String() string { return proto.CompactTextString(m) }
+func (*VersionResponse) ProtoMessage()    {}
+
+func (m *VersionResponse) GetVersion() string {
+	if m != nil && m.Version != nil {
+		return *m.Version
+	}
+	return ""
+}
+
+func (m *VersionResponse) GetRuntimeName() string {
+	if m != nil && m.RuntimeName != nil {
+		return *m.RuntimeName
+	}
+	return ""
+}
+
+func (m *VersionResponse) GetRuntimeVersion() string {
+	if m != nil && m.RuntimeVersion != nil {
+		return *m.RuntimeVersion
+	}
+	return ""
+}
+
+func (m *VersionResponse) GetRuntimeApiVersion() string {
+	if m != nil && m.RuntimeApiVersion != nil {
+		return *m.RuntimeApiVersion
+	}
+	return ""
+}
+
+// DNSOption specifies the DNS servers and search domains.
+type DNSOption struct {
+	// List of DNS servers of the cluster.
+	Servers []string `protobuf:"bytes,1,rep,name=servers" json:"servers,omitempty"`
+	// List of DNS search domains of the cluster.
+	Searches         []string `protobuf:"bytes,2,rep,name=searches" json:"searches,omitempty"`
+	XXX_unrecognized []byte   `json:"-"`
+}
+
+func (m *DNSOption) Reset()         { *m = DNSOption{} }
+func (m *DNSOption) String() string { return proto.CompactTextString(m) }
+func (*DNSOption) ProtoMessage()    {}
+
+func (m *DNSOption) GetServers() []string {
+	if m != nil {
+		return m.Servers
+	}
+	return nil
+}
+
+func (m *DNSOption) GetSearches() []string {
+	if m != nil {
+		return m.Searches
+	}
+	return nil
+}
+
+// PortMapping specifies the port mapping configurations of sandbox
+type PortMapping struct {
+	// The name of the port mapping
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// The protocol of the port mapping.
+	Protocol *Protocol `protobuf:"varint,2,opt,name=protocol,enum=runtime.Protocol" json:"protocol,omitempty"`
+	// The port number within the container.
+	ContainerPort *int32 `protobuf:"varint,3,opt,name=container_port" json:"container_port,omitempty"`
+	// The port number on the host.
+	HostPort *int32 `protobuf:"varint,4,opt,name=host_port" json:"host_port,omitempty"`
+	// The host IP.
+	HostIp           *string `protobuf:"bytes,5,opt,name=host_ip" json:"host_ip,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *PortMapping) Reset()         { *m = PortMapping{} }
+func (m *PortMapping) String() string { return proto.CompactTextString(m) }
+func (*PortMapping) ProtoMessage()    {}
+
+func (m *PortMapping) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *PortMapping) GetProtocol() Protocol {
+	if m != nil && m.Protocol != nil {
+		return *m.Protocol
+	}
+	return Protocol_TCP
+}
+
+func (m *PortMapping) GetContainerPort() int32 {
+	if m != nil && m.ContainerPort != nil {
+		return *m.ContainerPort
+	}
+	return 0
+}
+
+func (m *PortMapping) GetHostPort() int32 {
+	if m != nil && m.HostPort != nil {
+		return *m.HostPort
+	}
+	return 0
+}
+
+func (m *PortMapping) GetHostIp() string {
+	if m != nil && m.HostIp != nil {
+		return *m.HostIp
+	}
+	return ""
+}
+
+// Mount specifies the volume mount for the sandbox
+type Mount struct {
+	// The name of the volume mount.
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// The path of the mount within the container.
+	ContainerPath *string `protobuf:"bytes,2,opt,name=container_path" json:"container_path,omitempty"`
+	// The path of the mount on the host.
+	HostPath *string `protobuf:"bytes,3,opt,name=host_path" json:"host_path,omitempty"`
+	// If set, the mount is read-only.
+	Readonly *bool `protobuf:"varint,4,opt,name=readonly" json:"readonly,omitempty"`
+	// If set, the mount needs SELinux relabeling
+	SelinuxRelabel   *bool  `protobuf:"varint,5,opt,name=selinux_relabel" json:"selinux_relabel,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *Mount) Reset()         { *m = Mount{} }
+func (m *Mount) String() string { return proto.CompactTextString(m) }
+func (*Mount) ProtoMessage()    {}
+
+func (m *Mount) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *Mount) GetContainerPath() string {
+	if m != nil && m.ContainerPath != nil {
+		return *m.ContainerPath
+	}
+	return ""
+}
+
+func (m *Mount) GetHostPath() string {
+	if m != nil && m.HostPath != nil {
+		return *m.HostPath
+	}
+	return ""
+}
+
+func (m *Mount) GetReadonly() bool {
+	if m != nil && m.Readonly != nil {
+		return *m.Readonly
+	}
+	return false
+}
+
+func (m *Mount) GetSelinuxRelabel() bool {
+	if m != nil && m.SelinuxRelabel != nil {
+		return *m.SelinuxRelabel
+	}
+	return false
+}
+
+// ResourceRequirements contains a set of resources
+// Valid resources are:
+// - cpu, in cores. (500m = .5 cores)
+// - memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
+type ResourceRequirements struct {
+	// The maximum amount of compute resources allowed.
+	Limits *float64 `protobuf:"fixed64,1,opt,name=limits" json:"limits,omitempty"`
+	// The minimum amount of compute resources required.
+	// If Request is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value
+	Requests         *float64 `protobuf:"fixed64,2,opt,name=requests" json:"requests,omitempty"`
+	XXX_unrecognized []byte   `json:"-"`
+}
+
+func (m *ResourceRequirements) Reset()         { *m = ResourceRequirements{} }
+func (m *ResourceRequirements) String() string { return proto.CompactTextString(m) }
+func (*ResourceRequirements) ProtoMessage()    {}
+
+func (m *ResourceRequirements) GetLimits() float64 {
+	if m != nil && m.Limits != nil {
+		return *m.Limits
+	}
+	return 0
+}
+
+func (m *ResourceRequirements) GetRequests() float64 {
+	if m != nil && m.Requests != nil {
+		return *m.Requests
+	}
+	return 0
+}
+
+// PodSandboxResources contains the CPU/memory resource requirements.
+type PodSandboxResources struct {
+	// CPU resource requirement.
+	Cpu *ResourceRequirements `protobuf:"bytes,1,opt,name=cpu" json:"cpu,omitempty"`
+	// Memory resource requirement.
+	Memory           *ResourceRequirements `protobuf:"bytes,2,opt,name=memory" json:"memory,omitempty"`
+	XXX_unrecognized []byte                `json:"-"`
+}
+
+func (m *PodSandboxResources) Reset()         { *m = PodSandboxResources{} }
+func (m *PodSandboxResources) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxResources) ProtoMessage()    {}
+
+func (m *PodSandboxResources) GetCpu() *ResourceRequirements {
+	if m != nil {
+		return m.Cpu
+	}
+	return nil
+}
+
+func (m *PodSandboxResources) GetMemory() *ResourceRequirements {
+	if m != nil {
+		return m.Memory
+	}
+	return nil
+}
+
+// NamespaceOption provides options for Linux namespaces.
+type NamespaceOption struct {
+	// If set, use the host's network namespace.
+	HostNetwork *bool `protobuf:"varint,1,opt,name=host_network" json:"host_network,omitempty"`
+	// If set, use the host's pid namesapce.
+	HostPid *bool `protobuf:"varint,2,opt,name=host_pid" json:"host_pid,omitempty"`
+	// If set, use the host's ipc namespace.
+	HostIpc          *bool  `protobuf:"varint,3,opt,name=host_ipc" json:"host_ipc,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *NamespaceOption) Reset()         { *m = NamespaceOption{} }
+func (m *NamespaceOption) String() string { return proto.CompactTextString(m) }
+func (*NamespaceOption) ProtoMessage()    {}
+
+func (m *NamespaceOption) GetHostNetwork() bool {
+	if m != nil && m.HostNetwork != nil {
+		return *m.HostNetwork
+	}
+	return false
+}
+
+func (m *NamespaceOption) GetHostPid() bool {
+	if m != nil && m.HostPid != nil {
+		return *m.HostPid
+	}
+	return false
+}
+
+func (m *NamespaceOption) GetHostIpc() bool {
+	if m != nil && m.HostIpc != nil {
+		return *m.HostIpc
+	}
+	return false
+}
+
+// LinuxPodSandboxConfig holds platform-specific configuraions for Linux
+// host platforms and Linux-based containers.
+type LinuxPodSandboxConfig struct {
+	// The parent cgroup of the pod sandbox.
+	// The cgroupfs style syntax will be used, but the container runtime can
+	// convert it to systemd semantices if needed.
+	CgroupParent *string `protobuf:"bytes,1,opt,name=cgroup_parent" json:"cgroup_parent,omitempty"`
+	// The configurations for the sandbox's namespaces.
+	// This will be used only if the PodSandbox uses namespace for isolation.
+	NamespaceOptions *NamespaceOption `protobuf:"bytes,2,opt,name=namespace_options" json:"namespace_options,omitempty"`
+	XXX_unrecognized []byte           `json:"-"`
+}
+
+func (m *LinuxPodSandboxConfig) Reset()         { *m = LinuxPodSandboxConfig{} }
+func (m *LinuxPodSandboxConfig) String() string { return proto.CompactTextString(m) }
+func (*LinuxPodSandboxConfig) ProtoMessage()    {}
+
+func (m *LinuxPodSandboxConfig) GetCgroupParent() string {
+	if m != nil && m.CgroupParent != nil {
+		return *m.CgroupParent
+	}
+	return ""
+}
+
+func (m *LinuxPodSandboxConfig) GetNamespaceOptions() *NamespaceOption {
+	if m != nil {
+		return m.NamespaceOptions
+	}
+	return nil
+}
+
+// PodSandboxConfig holds all the required and optional fields for creating a
+// sandbox.
+type PodSandboxConfig struct {
+	// The name of the sandbox.
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// The hostname of the sandbox.
+	Hostname *string `protobuf:"bytes,2,opt,name=hostname" json:"hostname,omitempty"`
+	// Path to the directory on the host in which container log files are
+	// stored.
+	// By default the log of a container going into the LogDirectory will be
+	// hooked up to STDOUT and STDERR. However, the LogDirectory may contain
+	// binary log files with structured logging data from the individual
+	// containers. For example the files might be newline seperated JSON
+	// structured logs, systemd-journald journal files, gRPC trace files, etc.
+	// E.g.,
+	//     PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/`
+	//     ContainerConfig.LogPath = `containerName_Instance#.log`
+	//
+	// WARNING: Log managment and how kubelet should interface with the
+	// container logs are under active discussion in
+	// https://issues.k8s.io/24677. There *may* be future change of direction
+	// for logging as the discussion carries on.
+	LogDirectory *string `protobuf:"bytes,3,opt,name=log_directory" json:"log_directory,omitempty"`
+	// The DNS options for the sandbox.
+	DnsOptions *DNSOption `protobuf:"bytes,4,opt,name=dns_options" json:"dns_options,omitempty"`
+	// The port mappings for the sandbox.
+	PortMappings []*PortMapping `protobuf:"bytes,5,rep,name=port_mappings" json:"port_mappings,omitempty"`
+	// Resources specifies the resource limits for the sandbox (i.e., the
+	// aggregate cpu/memory resources limits of all containers).
+	// Note: On a Linux host, kubelet will create a pod-level cgroup and pass
+	// it as the cgroup parent for the PodSandbox. For some runtimes, this is
+	// sufficent. For others, e.g., hypervisor-based runtimes, explicit
+	// resource limits for the sandbox are needed at creation time.
+	Resources *PodSandboxResources `protobuf:"bytes,6,opt,name=resources" json:"resources,omitempty"`
+	// Labels are key value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,7,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Annotations is an unstructured key value map that may be set by external
+	// tools to store and retrieve arbitrary metadata.
+	Annotations map[string]string `protobuf:"bytes,8,rep,name=annotations" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Optional configurations specific to Linux hosts.
+	Linux            *LinuxPodSandboxConfig `protobuf:"bytes,9,opt,name=linux" json:"linux,omitempty"`
+	XXX_unrecognized []byte                 `json:"-"`
+}
+
+func (m *PodSandboxConfig) Reset()         { *m = PodSandboxConfig{} }
+func (m *PodSandboxConfig) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxConfig) ProtoMessage()    {}
+
+func (m *PodSandboxConfig) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *PodSandboxConfig) GetHostname() string {
+	if m != nil && m.Hostname != nil {
+		return *m.Hostname
+	}
+	return ""
+}
+
+func (m *PodSandboxConfig) GetLogDirectory() string {
+	if m != nil && m.LogDirectory != nil {
+		return *m.LogDirectory
+	}
+	return ""
+}
+
+func (m *PodSandboxConfig) GetDnsOptions() *DNSOption {
+	if m != nil {
+		return m.DnsOptions
+	}
+	return nil
+}
+
+func (m *PodSandboxConfig) GetPortMappings() []*PortMapping {
+	if m != nil {
+		return m.PortMappings
+	}
+	return nil
+}
+
+func (m *PodSandboxConfig) GetResources() *PodSandboxResources {
+	if m != nil {
+		return m.Resources
+	}
+	return nil
+}
+
+func (m *PodSandboxConfig) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *PodSandboxConfig) GetAnnotations() map[string]string {
+	if m != nil {
+		return m.Annotations
+	}
+	return nil
+}
+
+func (m *PodSandboxConfig) GetLinux() *LinuxPodSandboxConfig {
+	if m != nil {
+		return m.Linux
+	}
+	return nil
+}
+
+type CreatePodSandboxRequest struct {
+	// The configuration for creating a PodSandBox.
+	Config           *PodSandboxConfig `protobuf:"bytes,1,opt,name=config" json:"config,omitempty"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *CreatePodSandboxRequest) Reset()         { *m = CreatePodSandboxRequest{} }
+func (m *CreatePodSandboxRequest) String() string { return proto.CompactTextString(m) }
+func (*CreatePodSandboxRequest) ProtoMessage()    {}
+
+func (m *CreatePodSandboxRequest) GetConfig() *PodSandboxConfig {
+	if m != nil {
+		return m.Config
+	}
+	return nil
+}
+
+type CreatePodSandboxResponse struct {
+	// The id of the PodSandBox
+	PodSandboxId     *string `protobuf:"bytes,1,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *CreatePodSandboxResponse) Reset()         { *m = CreatePodSandboxResponse{} }
+func (m *CreatePodSandboxResponse) String() string { return proto.CompactTextString(m) }
+func (*CreatePodSandboxResponse) ProtoMessage()    {}
+
+func (m *CreatePodSandboxResponse) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+type StopPodSandboxRequest struct {
+	// The id of the PodSandBox
+	PodSandboxId     *string `protobuf:"bytes,1,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *StopPodSandboxRequest) Reset()         { *m = StopPodSandboxRequest{} }
+func (m *StopPodSandboxRequest) String() string { return proto.CompactTextString(m) }
+func (*StopPodSandboxRequest) ProtoMessage()    {}
+
+func (m *StopPodSandboxRequest) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+type StopPodSandboxResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *StopPodSandboxResponse) Reset()         { *m = StopPodSandboxResponse{} }
+func (m *StopPodSandboxResponse) String() string { return proto.CompactTextString(m) }
+func (*StopPodSandboxResponse) ProtoMessage()    {}
+
+type DeletePodSandboxRequest struct {
+	// The id of the PodSandBox
+	PodSandboxId     *string `protobuf:"bytes,1,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *DeletePodSandboxRequest) Reset()         { *m = DeletePodSandboxRequest{} }
+func (m *DeletePodSandboxRequest) String() string { return proto.CompactTextString(m) }
+func (*DeletePodSandboxRequest) ProtoMessage()    {}
+
+func (m *DeletePodSandboxRequest) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+type DeletePodSandboxResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *DeletePodSandboxResponse) Reset()         { *m = DeletePodSandboxResponse{} }
+func (m *DeletePodSandboxResponse) String() string { return proto.CompactTextString(m) }
+func (*DeletePodSandboxResponse) ProtoMessage()    {}
+
+type PodSandboxStatusRequest struct {
+	// The id of the PodSandBox
+	PodSandboxId     *string `protobuf:"bytes,1,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *PodSandboxStatusRequest) Reset()         { *m = PodSandboxStatusRequest{} }
+func (m *PodSandboxStatusRequest) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxStatusRequest) ProtoMessage()    {}
+
+func (m *PodSandboxStatusRequest) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+// PodSandboxNetworkStatus is the status of the network for a PodSandbox.
+type PodSandboxNetworkStatus struct {
+	// The IP address of the PodSandbox
+	Ip               *string `protobuf:"bytes,1,opt,name=ip" json:"ip,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *PodSandboxNetworkStatus) Reset()         { *m = PodSandboxNetworkStatus{} }
+func (m *PodSandboxNetworkStatus) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxNetworkStatus) ProtoMessage()    {}
+
+func (m *PodSandboxNetworkStatus) GetIp() string {
+	if m != nil && m.Ip != nil {
+		return *m.Ip
+	}
+	return ""
+}
+
+// Namespace contains paths to the namespaces.
+type Namespace struct {
+	// Network is the path to the network namespace.
+	Network *string `protobuf:"bytes,1,opt,name=network" json:"network,omitempty"`
+	// Options is the namespace options for linux namespaces
+	Options          *NamespaceOption `protobuf:"bytes,2,opt,name=options" json:"options,omitempty"`
+	XXX_unrecognized []byte           `json:"-"`
+}
+
+func (m *Namespace) Reset()         { *m = Namespace{} }
+func (m *Namespace) String() string { return proto.CompactTextString(m) }
+func (*Namespace) ProtoMessage()    {}
+
+func (m *Namespace) GetNetwork() string {
+	if m != nil && m.Network != nil {
+		return *m.Network
+	}
+	return ""
+}
+
+func (m *Namespace) GetOptions() *NamespaceOption {
+	if m != nil {
+		return m.Options
+	}
+	return nil
+}
+
+// LinuxSandBoxStatus contains status specific to Linux sandboxes.
+type LinuxPodSandboxStatus struct {
+	// Namespaces contains paths to the sandbox's namespaces.
+	Namespaces       *Namespace `protobuf:"bytes,1,opt,name=namespaces" json:"namespaces,omitempty"`
+	XXX_unrecognized []byte     `json:"-"`
+}
+
+func (m *LinuxPodSandboxStatus) Reset()         { *m = LinuxPodSandboxStatus{} }
+func (m *LinuxPodSandboxStatus) String() string { return proto.CompactTextString(m) }
+func (*LinuxPodSandboxStatus) ProtoMessage()    {}
+
+func (m *LinuxPodSandboxStatus) GetNamespaces() *Namespace {
+	if m != nil {
+		return m.Namespaces
+	}
+	return nil
+}
+
+// PodSandboxStatus contains the status of the PodSandbox.
+type PodSandboxStatus struct {
+	// ID of the sandbox.
+	Id *string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	// Name of the sandbox
+	Name *string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"`
+	// State of the sandbox.
+	State *PodSandBoxState `protobuf:"varint,3,opt,name=state,enum=runtime.PodSandBoxState" json:"state,omitempty"`
+	// Creation timestamp of the sandbox
+	CreatedAt *int64 `protobuf:"varint,4,opt,name=created_at" json:"created_at,omitempty"`
+	// Network contains network status if network is handled by the runtime.
+	Network *PodSandboxNetworkStatus `protobuf:"bytes,5,opt,name=network" json:"network,omitempty"`
+	// Linux specific status to a pod sandbox.
+	Linux *LinuxPodSandboxStatus `protobuf:"bytes,6,opt,name=linux" json:"linux,omitempty"`
+	// Labels are key value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,7,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Annotations is an unstructured key value map that may be set by external
+	// tools to store and retrieve arbitrary metadata.
+	Annotations      map[string]string `protobuf:"bytes,8,rep,name=annotations" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *PodSandboxStatus) Reset()         { *m = PodSandboxStatus{} }
+func (m *PodSandboxStatus) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxStatus) ProtoMessage()    {}
+
+func (m *PodSandboxStatus) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *PodSandboxStatus) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *PodSandboxStatus) GetState() PodSandBoxState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return PodSandBoxState_READY
+}
+
+func (m *PodSandboxStatus) GetCreatedAt() int64 {
+	if m != nil && m.CreatedAt != nil {
+		return *m.CreatedAt
+	}
+	return 0
+}
+
+func (m *PodSandboxStatus) GetNetwork() *PodSandboxNetworkStatus {
+	if m != nil {
+		return m.Network
+	}
+	return nil
+}
+
+func (m *PodSandboxStatus) GetLinux() *LinuxPodSandboxStatus {
+	if m != nil {
+		return m.Linux
+	}
+	return nil
+}
+
+func (m *PodSandboxStatus) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *PodSandboxStatus) GetAnnotations() map[string]string {
+	if m != nil {
+		return m.Annotations
+	}
+	return nil
+}
+
+type PodSandboxStatusResponse struct {
+	// The status of the PodSandbox
+	Status           *PodSandboxStatus `protobuf:"bytes,1,opt,name=status" json:"status,omitempty"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *PodSandboxStatusResponse) Reset()         { *m = PodSandboxStatusResponse{} }
+func (m *PodSandboxStatusResponse) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxStatusResponse) ProtoMessage()    {}
+
+func (m *PodSandboxStatusResponse) GetStatus() *PodSandboxStatus {
+	if m != nil {
+		return m.Status
+	}
+	return nil
+}
+
+// PodSandboxFilter is used to filter a list of PodSandboxes.
+// All those fields are combined with 'AND'
+type PodSandboxFilter struct {
+	// Name of the sandbox.
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// ID of the sandbox.
+	Id *string `protobuf:"bytes,2,opt,name=id" json:"id,omitempty"`
+	// State of the sandbox.
+	State *PodSandBoxState `protobuf:"varint,3,opt,name=state,enum=runtime.PodSandBoxState" json:"state,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector    map[string]string `protobuf:"bytes,4,rep,name=label_selector" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *PodSandboxFilter) Reset()         { *m = PodSandboxFilter{} }
+func (m *PodSandboxFilter) String() string { return proto.CompactTextString(m) }
+func (*PodSandboxFilter) ProtoMessage()    {}
+
+func (m *PodSandboxFilter) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *PodSandboxFilter) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *PodSandboxFilter) GetState() PodSandBoxState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return PodSandBoxState_READY
+}
+
+func (m *PodSandboxFilter) GetLabelSelector() map[string]string {
+	if m != nil {
+		return m.LabelSelector
+	}
+	return nil
+}
+
+type ListPodSandboxRequest struct {
+	// PodSandboxFilter to filter a list of PodSandboxes.
+	Filter           *PodSandboxFilter `protobuf:"bytes,1,opt,name=filter" json:"filter,omitempty"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *ListPodSandboxRequest) Reset()         { *m = ListPodSandboxRequest{} }
+func (m *ListPodSandboxRequest) String() string { return proto.CompactTextString(m) }
+func (*ListPodSandboxRequest) ProtoMessage()    {}
+
+func (m *ListPodSandboxRequest) GetFilter() *PodSandboxFilter {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+// PodSandbox contains minimal information about a sandbox.
+type PodSandbox struct {
+	// The id of the PodSandbox
+	Id *string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	// The name of the PodSandbox
+	Name *string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"`
+	// The state of the PodSandbox
+	State *PodSandBoxState `protobuf:"varint,3,opt,name=state,enum=runtime.PodSandBoxState" json:"state,omitempty"`
+	// Creation timestamps of the sandbox
+	CreatedAt *int64 `protobuf:"varint,4,opt,name=created_at" json:"created_at,omitempty"`
+	// The labels of the PodSandbox
+	Labels           map[string]string `protobuf:"bytes,5,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *PodSandbox) Reset()         { *m = PodSandbox{} }
+func (m *PodSandbox) String() string { return proto.CompactTextString(m) }
+func (*PodSandbox) ProtoMessage()    {}
+
+func (m *PodSandbox) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *PodSandbox) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *PodSandbox) GetState() PodSandBoxState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return PodSandBoxState_READY
+}
+
+func (m *PodSandbox) GetCreatedAt() int64 {
+	if m != nil && m.CreatedAt != nil {
+		return *m.CreatedAt
+	}
+	return 0
+}
+
+func (m *PodSandbox) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+type ListPodSandboxResponse struct {
+	// List of PodSandbox
+	Items            []*PodSandbox `protobuf:"bytes,1,rep,name=items" json:"items,omitempty"`
+	XXX_unrecognized []byte        `json:"-"`
+}
+
+func (m *ListPodSandboxResponse) Reset()         { *m = ListPodSandboxResponse{} }
+func (m *ListPodSandboxResponse) String() string { return proto.CompactTextString(m) }
+func (*ListPodSandboxResponse) ProtoMessage()    {}
+
+func (m *ListPodSandboxResponse) GetItems() []*PodSandbox {
+	if m != nil {
+		return m.Items
+	}
+	return nil
+}
+
+// ImageSpec is an internal representation of an image.  Currently, it wraps the
+// value of a Container's Image field (e.g. imageName, imageName:tag, or
+// imageName:digest), but in the future it will include more detailed
+// information about the different image types.
+type ImageSpec struct {
+	Image            *string `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *ImageSpec) Reset()         { *m = ImageSpec{} }
+func (m *ImageSpec) String() string { return proto.CompactTextString(m) }
+func (*ImageSpec) ProtoMessage()    {}
+
+func (m *ImageSpec) GetImage() string {
+	if m != nil && m.Image != nil {
+		return *m.Image
+	}
+	return ""
+}
+
+type KeyValue struct {
+	Key              *string `protobuf:"bytes,1,opt,name=key" json:"key,omitempty"`
+	Value            *string `protobuf:"bytes,2,opt,name=value" json:"value,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *KeyValue) Reset()         { *m = KeyValue{} }
+func (m *KeyValue) String() string { return proto.CompactTextString(m) }
+func (*KeyValue) ProtoMessage()    {}
+
+func (m *KeyValue) GetKey() string {
+	if m != nil && m.Key != nil {
+		return *m.Key
+	}
+	return ""
+}
+
+func (m *KeyValue) GetValue() string {
+	if m != nil && m.Value != nil {
+		return *m.Value
+	}
+	return ""
+}
+
+// LinuxContainerResources specifies Linux specific configuration for
+// resources.
+// TODO: Consider using Resources from opencontainers/runtime-spec/specs-go
+// directly.
+type LinuxContainerResources struct {
+	// CPU CFS (Completely Fair Scheduler) period
+	CpuPeriod *int64 `protobuf:"varint,1,opt,name=cpu_period" json:"cpu_period,omitempty"`
+	// CPU CFS (Completely Fair Scheduler) quota
+	CpuQuota *int64 `protobuf:"varint,2,opt,name=cpu_quota" json:"cpu_quota,omitempty"`
+	// CPU shares (relative weight vs. other containers)
+	CpuShares *int64 `protobuf:"varint,3,opt,name=cpu_shares" json:"cpu_shares,omitempty"`
+	// Memory limit in bytes
+	MemoryLimitInBytes *int64 `protobuf:"varint,4,opt,name=memory_limit_in_bytes" json:"memory_limit_in_bytes,omitempty"`
+	// OOMScoreAdj adjusts the oom-killer score.
+	OomScoreAdj      *int64 `protobuf:"varint,5,opt,name=oom_score_adj" json:"oom_score_adj,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *LinuxContainerResources) Reset()         { *m = LinuxContainerResources{} }
+func (m *LinuxContainerResources) String() string { return proto.CompactTextString(m) }
+func (*LinuxContainerResources) ProtoMessage()    {}
+
+func (m *LinuxContainerResources) GetCpuPeriod() int64 {
+	if m != nil && m.CpuPeriod != nil {
+		return *m.CpuPeriod
+	}
+	return 0
+}
+
+func (m *LinuxContainerResources) GetCpuQuota() int64 {
+	if m != nil && m.CpuQuota != nil {
+		return *m.CpuQuota
+	}
+	return 0
+}
+
+func (m *LinuxContainerResources) GetCpuShares() int64 {
+	if m != nil && m.CpuShares != nil {
+		return *m.CpuShares
+	}
+	return 0
+}
+
+func (m *LinuxContainerResources) GetMemoryLimitInBytes() int64 {
+	if m != nil && m.MemoryLimitInBytes != nil {
+		return *m.MemoryLimitInBytes
+	}
+	return 0
+}
+
+func (m *LinuxContainerResources) GetOomScoreAdj() int64 {
+	if m != nil && m.OomScoreAdj != nil {
+		return *m.OomScoreAdj
+	}
+	return 0
+}
+
+// SELinuxOption are the labels to be applied to the container.
+type SELinuxOption struct {
+	User             *string `protobuf:"bytes,1,opt,name=user" json:"user,omitempty"`
+	Role             *string `protobuf:"bytes,2,opt,name=role" json:"role,omitempty"`
+	Type             *string `protobuf:"bytes,3,opt,name=type" json:"type,omitempty"`
+	Level            *string `protobuf:"bytes,4,opt,name=level" json:"level,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *SELinuxOption) Reset()         { *m = SELinuxOption{} }
+func (m *SELinuxOption) String() string { return proto.CompactTextString(m) }
+func (*SELinuxOption) ProtoMessage()    {}
+
+func (m *SELinuxOption) GetUser() string {
+	if m != nil && m.User != nil {
+		return *m.User
+	}
+	return ""
+}
+
+func (m *SELinuxOption) GetRole() string {
+	if m != nil && m.Role != nil {
+		return *m.Role
+	}
+	return ""
+}
+
+func (m *SELinuxOption) GetType() string {
+	if m != nil && m.Type != nil {
+		return *m.Type
+	}
+	return ""
+}
+
+func (m *SELinuxOption) GetLevel() string {
+	if m != nil && m.Level != nil {
+		return *m.Level
+	}
+	return ""
+}
+
+// Capability contains the container capabilities to add or drop
+type Capability struct {
+	// List of capabilities to add.
+	AddCapabilities []string `protobuf:"bytes,1,rep,name=add_capabilities" json:"add_capabilities,omitempty"`
+	// List of capabilities to drop.
+	DropCapabilities []string `protobuf:"bytes,2,rep,name=drop_capabilities" json:"drop_capabilities,omitempty"`
+	XXX_unrecognized []byte   `json:"-"`
+}
+
+func (m *Capability) Reset()         { *m = Capability{} }
+func (m *Capability) String() string { return proto.CompactTextString(m) }
+func (*Capability) ProtoMessage()    {}
+
+func (m *Capability) GetAddCapabilities() []string {
+	if m != nil {
+		return m.AddCapabilities
+	}
+	return nil
+}
+
+func (m *Capability) GetDropCapabilities() []string {
+	if m != nil {
+		return m.DropCapabilities
+	}
+	return nil
+}
+
+// LinuxContainerConfig contains platform-specific configuration for
+// Linux-based containers.
+type LinuxContainerConfig struct {
+	// Resources specification for the container.
+	Resources *LinuxContainerResources `protobuf:"bytes,1,opt,name=resources" json:"resources,omitempty"`
+	// Capabilities to add or drop.
+	Capabilities *Capability `protobuf:"bytes,2,opt,name=capabilities" json:"capabilities,omitempty"`
+	// Optional SELinux context to be applied.
+	SelinuxOptions   *SELinuxOption `protobuf:"bytes,3,opt,name=selinux_options" json:"selinux_options,omitempty"`
+	XXX_unrecognized []byte         `json:"-"`
+}
+
+func (m *LinuxContainerConfig) Reset()         { *m = LinuxContainerConfig{} }
+func (m *LinuxContainerConfig) String() string { return proto.CompactTextString(m) }
+func (*LinuxContainerConfig) ProtoMessage()    {}
+
+func (m *LinuxContainerConfig) GetResources() *LinuxContainerResources {
+	if m != nil {
+		return m.Resources
+	}
+	return nil
+}
+
+func (m *LinuxContainerConfig) GetCapabilities() *Capability {
+	if m != nil {
+		return m.Capabilities
+	}
+	return nil
+}
+
+func (m *LinuxContainerConfig) GetSelinuxOptions() *SELinuxOption {
+	if m != nil {
+		return m.SelinuxOptions
+	}
+	return nil
+}
+
+type ContainerConfig struct {
+	// Name of the container.
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// Image to use.
+	Image *ImageSpec `protobuf:"bytes,2,opt,name=image" json:"image,omitempty"`
+	// Command to execute (i.e., entrypoint for docker)
+	Command []string `protobuf:"bytes,3,rep,name=command" json:"command,omitempty"`
+	// Args for the Command (i.e., command for docker)
+	Args []string `protobuf:"bytes,4,rep,name=args" json:"args,omitempty"`
+	// Current working directory of the command.
+	WorkingDir *string `protobuf:"bytes,5,opt,name=working_dir" json:"working_dir,omitempty"`
+	// List of environment variable to set in the container
+	Envs []*KeyValue `protobuf:"bytes,6,rep,name=envs" json:"envs,omitempty"`
+	// Mounts specifies mounts for the container
+	Mounts []*Mount `protobuf:"bytes,7,rep,name=mounts" json:"mounts,omitempty"`
+	// Labels are key value pairs that may be used to scope and select individual resources.
+	// Label keys are of the form:
+	//     label-key ::= prefixed-name | name
+	//     prefixed-name ::= prefix '/' name
+	//     prefix ::= DNS_SUBDOMAIN
+	//     name ::= DNS_LABEL
+	Labels map[string]string `protobuf:"bytes,8,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Annotations is an unstructured key value map that may be set by external
+	// tools to store and retrieve arbitrary metadata.
+	Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// If set, run container in privileged mode.
+	// Processes in privileged containers are essentially equivalent to root on the host.
+	Privileged *bool `protobuf:"varint,10,opt,name=privileged" json:"privileged,omitempty"`
+	// If set, the root filesystem of the container is read-only.
+	ReadonlyRootfs *bool `protobuf:"varint,11,opt,name=readonly_rootfs" json:"readonly_rootfs,omitempty"`
+	// Path relative to PodSandboxConfig.LogDirectory for container to store
+	// the log (STDOUT and STDERR) on the host.
+	// E.g.,
+	//     PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/`
+	//     ContainerConfig.LogPath = `containerName_Instance#.log`
+	//
+	// WARNING: Log managment and how kubelet should interface with the
+	// container logs are under active discussion in
+	// https://issues.k8s.io/24677. There *may* be future change of direction
+	// for logging as the discussion carries on.
+	LogPath *string `protobuf:"bytes,12,opt,name=log_path" json:"log_path,omitempty"`
+	// Variables for interactive containers, these have very specialized
+	// use-cases (e.g. debugging).
+	// TODO: Determine if we need to continue supporting these fields that are
+	// part of Kubernetes's Container Spec.
+	Stdin     *bool `protobuf:"varint,13,opt,name=stdin" json:"stdin,omitempty"`
+	StdinOnce *bool `protobuf:"varint,14,opt,name=stdin_once" json:"stdin_once,omitempty"`
+	Tty       *bool `protobuf:"varint,15,opt,name=tty" json:"tty,omitempty"`
+	// Linux contains configuration specific to Linux containers.
+	Linux            *LinuxContainerConfig `protobuf:"bytes,16,opt,name=linux" json:"linux,omitempty"`
+	XXX_unrecognized []byte                `json:"-"`
+}
+
+func (m *ContainerConfig) Reset()         { *m = ContainerConfig{} }
+func (m *ContainerConfig) String() string { return proto.CompactTextString(m) }
+func (*ContainerConfig) ProtoMessage()    {}
+
+func (m *ContainerConfig) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *ContainerConfig) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetCommand() []string {
+	if m != nil {
+		return m.Command
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetArgs() []string {
+	if m != nil {
+		return m.Args
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetWorkingDir() string {
+	if m != nil && m.WorkingDir != nil {
+		return *m.WorkingDir
+	}
+	return ""
+}
+
+func (m *ContainerConfig) GetEnvs() []*KeyValue {
+	if m != nil {
+		return m.Envs
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetMounts() []*Mount {
+	if m != nil {
+		return m.Mounts
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetAnnotations() map[string]string {
+	if m != nil {
+		return m.Annotations
+	}
+	return nil
+}
+
+func (m *ContainerConfig) GetPrivileged() bool {
+	if m != nil && m.Privileged != nil {
+		return *m.Privileged
+	}
+	return false
+}
+
+func (m *ContainerConfig) GetReadonlyRootfs() bool {
+	if m != nil && m.ReadonlyRootfs != nil {
+		return *m.ReadonlyRootfs
+	}
+	return false
+}
+
+func (m *ContainerConfig) GetLogPath() string {
+	if m != nil && m.LogPath != nil {
+		return *m.LogPath
+	}
+	return ""
+}
+
+func (m *ContainerConfig) GetStdin() bool {
+	if m != nil && m.Stdin != nil {
+		return *m.Stdin
+	}
+	return false
+}
+
+func (m *ContainerConfig) GetStdinOnce() bool {
+	if m != nil && m.StdinOnce != nil {
+		return *m.StdinOnce
+	}
+	return false
+}
+
+func (m *ContainerConfig) GetTty() bool {
+	if m != nil && m.Tty != nil {
+		return *m.Tty
+	}
+	return false
+}
+
+func (m *ContainerConfig) GetLinux() *LinuxContainerConfig {
+	if m != nil {
+		return m.Linux
+	}
+	return nil
+}
+
+type CreateContainerRequest struct {
+	// The id of the PodSandbox
+	PodSandboxId *string `protobuf:"bytes,1,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	// The config of the container
+	Config *ContainerConfig `protobuf:"bytes,2,opt,name=config" json:"config,omitempty"`
+	// The config of the PodSandbox
+	SandboxConfig    *PodSandboxConfig `protobuf:"bytes,3,opt,name=sandbox_config" json:"sandbox_config,omitempty"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *CreateContainerRequest) Reset()         { *m = CreateContainerRequest{} }
+func (m *CreateContainerRequest) String() string { return proto.CompactTextString(m) }
+func (*CreateContainerRequest) ProtoMessage()    {}
+
+func (m *CreateContainerRequest) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+func (m *CreateContainerRequest) GetConfig() *ContainerConfig {
+	if m != nil {
+		return m.Config
+	}
+	return nil
+}
+
+func (m *CreateContainerRequest) GetSandboxConfig() *PodSandboxConfig {
+	if m != nil {
+		return m.SandboxConfig
+	}
+	return nil
+}
+
+type CreateContainerResponse struct {
+	// The id of the created container
+	ContainerId      *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *CreateContainerResponse) Reset()         { *m = CreateContainerResponse{} }
+func (m *CreateContainerResponse) String() string { return proto.CompactTextString(m) }
+func (*CreateContainerResponse) ProtoMessage()    {}
+
+func (m *CreateContainerResponse) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+type StartContainerRequest struct {
+	// The id of the container
+	ContainerId      *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *StartContainerRequest) Reset()         { *m = StartContainerRequest{} }
+func (m *StartContainerRequest) String() string { return proto.CompactTextString(m) }
+func (*StartContainerRequest) ProtoMessage()    {}
+
+func (m *StartContainerRequest) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+type StartContainerResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *StartContainerResponse) Reset()         { *m = StartContainerResponse{} }
+func (m *StartContainerResponse) String() string { return proto.CompactTextString(m) }
+func (*StartContainerResponse) ProtoMessage()    {}
+
+type StopContainerRequest struct {
+	// The id of the container
+	ContainerId *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	// Timeout in seconds to stop the container
+	Timeout          *int64 `protobuf:"varint,2,opt,name=timeout" json:"timeout,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *StopContainerRequest) Reset()         { *m = StopContainerRequest{} }
+func (m *StopContainerRequest) String() string { return proto.CompactTextString(m) }
+func (*StopContainerRequest) ProtoMessage()    {}
+
+func (m *StopContainerRequest) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+func (m *StopContainerRequest) GetTimeout() int64 {
+	if m != nil && m.Timeout != nil {
+		return *m.Timeout
+	}
+	return 0
+}
+
+type StopContainerResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *StopContainerResponse) Reset()         { *m = StopContainerResponse{} }
+func (m *StopContainerResponse) String() string { return proto.CompactTextString(m) }
+func (*StopContainerResponse) ProtoMessage()    {}
+
+type RemoveContainerRequest struct {
+	// The id of the container
+	ContainerId      *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *RemoveContainerRequest) Reset()         { *m = RemoveContainerRequest{} }
+func (m *RemoveContainerRequest) String() string { return proto.CompactTextString(m) }
+func (*RemoveContainerRequest) ProtoMessage()    {}
+
+func (m *RemoveContainerRequest) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+type RemoveContainerResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *RemoveContainerResponse) Reset()         { *m = RemoveContainerResponse{} }
+func (m *RemoveContainerResponse) String() string { return proto.CompactTextString(m) }
+func (*RemoveContainerResponse) ProtoMessage()    {}
+
+// ContainerFilter is used to filter containers.
+// All those fields are combined with 'AND'
+type ContainerFilter struct {
+	// Name of the container.
+	Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// ID of the container.
+	Id *string `protobuf:"bytes,2,opt,name=id" json:"id,omitempty"`
+	// State of the contianer.
+	State *ContainerState `protobuf:"varint,3,opt,name=state,enum=runtime.ContainerState" json:"state,omitempty"`
+	// The id of the pod sandbox
+	PodSandboxId *string `protobuf:"bytes,4,opt,name=pod_sandbox_id" json:"pod_sandbox_id,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector    map[string]string `protobuf:"bytes,5,rep,name=label_selector" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *ContainerFilter) Reset()         { *m = ContainerFilter{} }
+func (m *ContainerFilter) String() string { return proto.CompactTextString(m) }
+func (*ContainerFilter) ProtoMessage()    {}
+
+func (m *ContainerFilter) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *ContainerFilter) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *ContainerFilter) GetState() ContainerState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return ContainerState_CREATED
+}
+
+func (m *ContainerFilter) GetPodSandboxId() string {
+	if m != nil && m.PodSandboxId != nil {
+		return *m.PodSandboxId
+	}
+	return ""
+}
+
+func (m *ContainerFilter) GetLabelSelector() map[string]string {
+	if m != nil {
+		return m.LabelSelector
+	}
+	return nil
+}
+
+type ListContainersRequest struct {
+	Filter           *ContainerFilter `protobuf:"bytes,1,opt,name=filter" json:"filter,omitempty"`
+	XXX_unrecognized []byte           `json:"-"`
+}
+
+func (m *ListContainersRequest) Reset()         { *m = ListContainersRequest{} }
+func (m *ListContainersRequest) String() string { return proto.CompactTextString(m) }
+func (*ListContainersRequest) ProtoMessage()    {}
+
+func (m *ListContainersRequest) GetFilter() *ContainerFilter {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+// Container provides the runtime information for a container, such as ID, hash,
+// state of the container.
+type Container struct {
+	// The ID of the container, used by the container runtime to identify
+	// a container.
+	Id *string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	// The name of the container
+	Name *string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"`
+	// The spec of the image
+	Image *ImageSpec `protobuf:"bytes,3,opt,name=image" json:"image,omitempty"`
+	// Reference to the image in use. For most runtimes, this should be an
+	// image ID.
+	ImageRef *string `protobuf:"bytes,4,opt,name=image_ref" json:"image_ref,omitempty"`
+	// State is the state of the container.
+	State *ContainerState `protobuf:"varint,5,opt,name=state,enum=runtime.ContainerState" json:"state,omitempty"`
+	// Labels are key value pairs that may be used to scope and select individual resources.
+	Labels           map[string]string `protobuf:"bytes,6,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *Container) Reset()         { *m = Container{} }
+func (m *Container) String() string { return proto.CompactTextString(m) }
+func (*Container) ProtoMessage()    {}
+
+func (m *Container) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *Container) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *Container) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+func (m *Container) GetImageRef() string {
+	if m != nil && m.ImageRef != nil {
+		return *m.ImageRef
+	}
+	return ""
+}
+
+func (m *Container) GetState() ContainerState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return ContainerState_CREATED
+}
+
+func (m *Container) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+type ListContainersResponse struct {
+	// List of containers
+	Containers       []*Container `protobuf:"bytes,1,rep,name=containers" json:"containers,omitempty"`
+	XXX_unrecognized []byte       `json:"-"`
+}
+
+func (m *ListContainersResponse) Reset()         { *m = ListContainersResponse{} }
+func (m *ListContainersResponse) String() string { return proto.CompactTextString(m) }
+func (*ListContainersResponse) ProtoMessage()    {}
+
+func (m *ListContainersResponse) GetContainers() []*Container {
+	if m != nil {
+		return m.Containers
+	}
+	return nil
+}
+
+type ContainerStatusRequest struct {
+	// The id of the container
+	ContainerId      *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *ContainerStatusRequest) Reset()         { *m = ContainerStatusRequest{} }
+func (m *ContainerStatusRequest) String() string { return proto.CompactTextString(m) }
+func (*ContainerStatusRequest) ProtoMessage()    {}
+
+func (m *ContainerStatusRequest) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+// ContainerStatus represents the status of a container.
+type ContainerStatus struct {
+	// ID of the container.
+	Id *string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	// Name of the container.
+	Name *string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"`
+	// Status of the container.
+	State *ContainerState `protobuf:"varint,3,opt,name=state,enum=runtime.ContainerState" json:"state,omitempty"`
+	// Creation time of the container.
+	CreatedAt *int64 `protobuf:"varint,4,opt,name=created_at" json:"created_at,omitempty"`
+	// Start time of the container.
+	StartedAt *int64 `protobuf:"varint,5,opt,name=started_at" json:"started_at,omitempty"`
+	// Finish time of the container.
+	FinishedAt *int64 `protobuf:"varint,6,opt,name=finished_at" json:"finished_at,omitempty"`
+	// Exit code of the container.
+	ExitCode *int32 `protobuf:"varint,7,opt,name=exit_code" json:"exit_code,omitempty"`
+	// The spec of the image
+	Image *ImageSpec `protobuf:"bytes,8,opt,name=image" json:"image,omitempty"`
+	// Reference to the image in use. For most runtimes, this should be an
+	// image ID
+	ImageRef *string `protobuf:"bytes,9,opt,name=image_ref" json:"image_ref,omitempty"`
+	// A string explains why container is in such a status.
+	Reason *string `protobuf:"bytes,10,opt,name=reason" json:"reason,omitempty"`
+	// Labels are key value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,11,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Annotations is an unstructured key value map.
+	Annotations map[string]string `protobuf:"bytes,12,rep,name=annotations" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Mounts specifies mounts for the container
+	Mounts           []*Mount `protobuf:"bytes,13,rep,name=mounts" json:"mounts,omitempty"`
+	XXX_unrecognized []byte   `json:"-"`
+}
+
+func (m *ContainerStatus) Reset()         { *m = ContainerStatus{} }
+func (m *ContainerStatus) String() string { return proto.CompactTextString(m) }
+func (*ContainerStatus) ProtoMessage()    {}
+
+func (m *ContainerStatus) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *ContainerStatus) GetName() string {
+	if m != nil && m.Name != nil {
+		return *m.Name
+	}
+	return ""
+}
+
+func (m *ContainerStatus) GetState() ContainerState {
+	if m != nil && m.State != nil {
+		return *m.State
+	}
+	return ContainerState_CREATED
+}
+
+func (m *ContainerStatus) GetCreatedAt() int64 {
+	if m != nil && m.CreatedAt != nil {
+		return *m.CreatedAt
+	}
+	return 0
+}
+
+func (m *ContainerStatus) GetStartedAt() int64 {
+	if m != nil && m.StartedAt != nil {
+		return *m.StartedAt
+	}
+	return 0
+}
+
+func (m *ContainerStatus) GetFinishedAt() int64 {
+	if m != nil && m.FinishedAt != nil {
+		return *m.FinishedAt
+	}
+	return 0
+}
+
+func (m *ContainerStatus) GetExitCode() int32 {
+	if m != nil && m.ExitCode != nil {
+		return *m.ExitCode
+	}
+	return 0
+}
+
+func (m *ContainerStatus) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+func (m *ContainerStatus) GetImageRef() string {
+	if m != nil && m.ImageRef != nil {
+		return *m.ImageRef
+	}
+	return ""
+}
+
+func (m *ContainerStatus) GetReason() string {
+	if m != nil && m.Reason != nil {
+		return *m.Reason
+	}
+	return ""
+}
+
+func (m *ContainerStatus) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *ContainerStatus) GetAnnotations() map[string]string {
+	if m != nil {
+		return m.Annotations
+	}
+	return nil
+}
+
+func (m *ContainerStatus) GetMounts() []*Mount {
+	if m != nil {
+		return m.Mounts
+	}
+	return nil
+}
+
+type ContainerStatusResponse struct {
+	// The status of the container
+	Status           *ContainerStatus `protobuf:"bytes,1,opt,name=status" json:"status,omitempty"`
+	XXX_unrecognized []byte           `json:"-"`
+}
+
+func (m *ContainerStatusResponse) Reset()         { *m = ContainerStatusResponse{} }
+func (m *ContainerStatusResponse) String() string { return proto.CompactTextString(m) }
+func (*ContainerStatusResponse) ProtoMessage()    {}
+
+func (m *ContainerStatusResponse) GetStatus() *ContainerStatus {
+	if m != nil {
+		return m.Status
+	}
+	return nil
+}
+
+type ExecRequest struct {
+	// The id of the container
+	ContainerId *string `protobuf:"bytes,1,opt,name=container_id" json:"container_id,omitempty"`
+	// The cmd to execute
+	Cmd []string `protobuf:"bytes,2,rep,name=cmd" json:"cmd,omitempty"`
+	// Whether use tty
+	Tty *bool `protobuf:"varint,3,opt,name=tty" json:"tty,omitempty"`
+	// Streaming stdin
+	Stdin            []byte `protobuf:"bytes,4,opt,name=stdin" json:"stdin,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *ExecRequest) Reset()         { *m = ExecRequest{} }
+func (m *ExecRequest) String() string { return proto.CompactTextString(m) }
+func (*ExecRequest) ProtoMessage()    {}
+
+func (m *ExecRequest) GetContainerId() string {
+	if m != nil && m.ContainerId != nil {
+		return *m.ContainerId
+	}
+	return ""
+}
+
+func (m *ExecRequest) GetCmd() []string {
+	if m != nil {
+		return m.Cmd
+	}
+	return nil
+}
+
+func (m *ExecRequest) GetTty() bool {
+	if m != nil && m.Tty != nil {
+		return *m.Tty
+	}
+	return false
+}
+
+func (m *ExecRequest) GetStdin() []byte {
+	if m != nil {
+		return m.Stdin
+	}
+	return nil
+}
+
+type ExecResponse struct {
+	// Streaming stdout
+	Stdout []byte `protobuf:"bytes,1,opt,name=stdout" json:"stdout,omitempty"`
+	// Streaming stderr
+	Stderr           []byte `protobuf:"bytes,2,opt,name=stderr" json:"stderr,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *ExecResponse) Reset()         { *m = ExecResponse{} }
+func (m *ExecResponse) String() string { return proto.CompactTextString(m) }
+func (*ExecResponse) ProtoMessage()    {}
+
+func (m *ExecResponse) GetStdout() []byte {
+	if m != nil {
+		return m.Stdout
+	}
+	return nil
+}
+
+func (m *ExecResponse) GetStderr() []byte {
+	if m != nil {
+		return m.Stderr
+	}
+	return nil
+}
+
+type ImageFilter struct {
+	// The spec of the image
+	Image            *ImageSpec `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	XXX_unrecognized []byte     `json:"-"`
+}
+
+func (m *ImageFilter) Reset()         { *m = ImageFilter{} }
+func (m *ImageFilter) String() string { return proto.CompactTextString(m) }
+func (*ImageFilter) ProtoMessage()    {}
+
+func (m *ImageFilter) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+type ListImagesRequest struct {
+	// The filter to list images
+	Filter           *ImageFilter `protobuf:"bytes,1,opt,name=filter" json:"filter,omitempty"`
+	XXX_unrecognized []byte       `json:"-"`
+}
+
+func (m *ListImagesRequest) Reset()         { *m = ListImagesRequest{} }
+func (m *ListImagesRequest) String() string { return proto.CompactTextString(m) }
+func (*ListImagesRequest) ProtoMessage()    {}
+
+func (m *ListImagesRequest) GetFilter() *ImageFilter {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+// Basic information about a container image.
+type Image struct {
+	// ID of the image.
+	Id *string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	// Other names by which this image is known.
+	RepoTags []string `protobuf:"bytes,2,rep,name=repo_tags" json:"repo_tags,omitempty"`
+	// Digests by which this image is known.
+	RepoDigests []string `protobuf:"bytes,3,rep,name=repo_digests" json:"repo_digests,omitempty"`
+	// The size of the image in bytes.
+	Size_            *uint64 `protobuf:"varint,4,opt,name=size" json:"size,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *Image) Reset()         { *m = Image{} }
+func (m *Image) String() string { return proto.CompactTextString(m) }
+func (*Image) ProtoMessage()    {}
+
+func (m *Image) GetId() string {
+	if m != nil && m.Id != nil {
+		return *m.Id
+	}
+	return ""
+}
+
+func (m *Image) GetRepoTags() []string {
+	if m != nil {
+		return m.RepoTags
+	}
+	return nil
+}
+
+func (m *Image) GetRepoDigests() []string {
+	if m != nil {
+		return m.RepoDigests
+	}
+	return nil
+}
+
+func (m *Image) GetSize_() uint64 {
+	if m != nil && m.Size_ != nil {
+		return *m.Size_
+	}
+	return 0
+}
+
+type ListImagesResponse struct {
+	// List of images
+	Images           []*Image `protobuf:"bytes,1,rep,name=images" json:"images,omitempty"`
+	XXX_unrecognized []byte   `json:"-"`
+}
+
+func (m *ListImagesResponse) Reset()         { *m = ListImagesResponse{} }
+func (m *ListImagesResponse) String() string { return proto.CompactTextString(m) }
+func (*ListImagesResponse) ProtoMessage()    {}
+
+func (m *ListImagesResponse) GetImages() []*Image {
+	if m != nil {
+		return m.Images
+	}
+	return nil
+}
+
+type ImageStatusRequest struct {
+	// The spec of the image
+	Image            *ImageSpec `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	XXX_unrecognized []byte     `json:"-"`
+}
+
+func (m *ImageStatusRequest) Reset()         { *m = ImageStatusRequest{} }
+func (m *ImageStatusRequest) String() string { return proto.CompactTextString(m) }
+func (*ImageStatusRequest) ProtoMessage()    {}
+
+func (m *ImageStatusRequest) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+type ImageStatusResponse struct {
+	// The status of the image
+	Image            *Image `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *ImageStatusResponse) Reset()         { *m = ImageStatusResponse{} }
+func (m *ImageStatusResponse) String() string { return proto.CompactTextString(m) }
+func (*ImageStatusResponse) ProtoMessage()    {}
+
+func (m *ImageStatusResponse) GetImage() *Image {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+// AuthConfig contains authorization information for connecting to a registry.
+type AuthConfig struct {
+	Username      *string `protobuf:"bytes,1,opt,name=username" json:"username,omitempty"`
+	Password      *string `protobuf:"bytes,2,opt,name=password" json:"password,omitempty"`
+	Auth          *string `protobuf:"bytes,3,opt,name=auth" json:"auth,omitempty"`
+	ServerAddress *string `protobuf:"bytes,4,opt,name=server_address" json:"server_address,omitempty"`
+	// IdentityToken is used to authenticate the user and get
+	// an access token for the registry.
+	IdentityToken *string `protobuf:"bytes,5,opt,name=identity_token" json:"identity_token,omitempty"`
+	// RegistryToken is a bearer token to be sent to a registry
+	RegistryToken    *string `protobuf:"bytes,6,opt,name=registry_token" json:"registry_token,omitempty"`
+	XXX_unrecognized []byte  `json:"-"`
+}
+
+func (m *AuthConfig) Reset()         { *m = AuthConfig{} }
+func (m *AuthConfig) String() string { return proto.CompactTextString(m) }
+func (*AuthConfig) ProtoMessage()    {}
+
+func (m *AuthConfig) GetUsername() string {
+	if m != nil && m.Username != nil {
+		return *m.Username
+	}
+	return ""
+}
+
+func (m *AuthConfig) GetPassword() string {
+	if m != nil && m.Password != nil {
+		return *m.Password
+	}
+	return ""
+}
+
+func (m *AuthConfig) GetAuth() string {
+	if m != nil && m.Auth != nil {
+		return *m.Auth
+	}
+	return ""
+}
+
+func (m *AuthConfig) GetServerAddress() string {
+	if m != nil && m.ServerAddress != nil {
+		return *m.ServerAddress
+	}
+	return ""
+}
+
+func (m *AuthConfig) GetIdentityToken() string {
+	if m != nil && m.IdentityToken != nil {
+		return *m.IdentityToken
+	}
+	return ""
+}
+
+func (m *AuthConfig) GetRegistryToken() string {
+	if m != nil && m.RegistryToken != nil {
+		return *m.RegistryToken
+	}
+	return ""
+}
+
+type PullImageRequest struct {
+	// The spec of the image
+	Image *ImageSpec `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	// The auth config for pulling image
+	Auth *AuthConfig `protobuf:"bytes,2,opt,name=auth" json:"auth,omitempty"`
+	// The config of the PodSandbox, which is used to pull image in PodSandbox context
+	SandboxConfig    *PodSandboxConfig `protobuf:"bytes,3,opt,name=sandbox_config" json:"sandbox_config,omitempty"`
+	XXX_unrecognized []byte            `json:"-"`
+}
+
+func (m *PullImageRequest) Reset()         { *m = PullImageRequest{} }
+func (m *PullImageRequest) String() string { return proto.CompactTextString(m) }
+func (*PullImageRequest) ProtoMessage()    {}
+
+func (m *PullImageRequest) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+func (m *PullImageRequest) GetAuth() *AuthConfig {
+	if m != nil {
+		return m.Auth
+	}
+	return nil
+}
+
+func (m *PullImageRequest) GetSandboxConfig() *PodSandboxConfig {
+	if m != nil {
+		return m.SandboxConfig
+	}
+	return nil
+}
+
+type PullImageResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *PullImageResponse) Reset()         { *m = PullImageResponse{} }
+func (m *PullImageResponse) String() string { return proto.CompactTextString(m) }
+func (*PullImageResponse) ProtoMessage()    {}
+
+type RemoveImageRequest struct {
+	// The spec of the image
+	Image            *ImageSpec `protobuf:"bytes,1,opt,name=image" json:"image,omitempty"`
+	XXX_unrecognized []byte     `json:"-"`
+}
+
+func (m *RemoveImageRequest) Reset()         { *m = RemoveImageRequest{} }
+func (m *RemoveImageRequest) String() string { return proto.CompactTextString(m) }
+func (*RemoveImageRequest) ProtoMessage()    {}
+
+func (m *RemoveImageRequest) GetImage() *ImageSpec {
+	if m != nil {
+		return m.Image
+	}
+	return nil
+}
+
+type RemoveImageResponse struct {
+	XXX_unrecognized []byte `json:"-"`
+}
+
+func (m *RemoveImageResponse) Reset()         { *m = RemoveImageResponse{} }
+func (m *RemoveImageResponse) String() string { return proto.CompactTextString(m) }
+func (*RemoveImageResponse) ProtoMessage()    {}
+
+func init() {
+	proto.RegisterType((*VersionRequest)(nil), "runtime.VersionRequest")
+	proto.RegisterType((*VersionResponse)(nil), "runtime.VersionResponse")
+	proto.RegisterType((*DNSOption)(nil), "runtime.DNSOption")
+	proto.RegisterType((*PortMapping)(nil), "runtime.PortMapping")
+	proto.RegisterType((*Mount)(nil), "runtime.Mount")
+	proto.RegisterType((*ResourceRequirements)(nil), "runtime.ResourceRequirements")
+	proto.RegisterType((*PodSandboxResources)(nil), "runtime.PodSandboxResources")
+	proto.RegisterType((*NamespaceOption)(nil), "runtime.NamespaceOption")
+	proto.RegisterType((*LinuxPodSandboxConfig)(nil), "runtime.LinuxPodSandboxConfig")
+	proto.RegisterType((*PodSandboxConfig)(nil), "runtime.PodSandboxConfig")
+	proto.RegisterType((*CreatePodSandboxRequest)(nil), "runtime.CreatePodSandboxRequest")
+	proto.RegisterType((*CreatePodSandboxResponse)(nil), "runtime.CreatePodSandboxResponse")
+	proto.RegisterType((*StopPodSandboxRequest)(nil), "runtime.StopPodSandboxRequest")
+	proto.RegisterType((*StopPodSandboxResponse)(nil), "runtime.StopPodSandboxResponse")
+	proto.RegisterType((*DeletePodSandboxRequest)(nil), "runtime.DeletePodSandboxRequest")
+	proto.RegisterType((*DeletePodSandboxResponse)(nil), "runtime.DeletePodSandboxResponse")
+	proto.RegisterType((*PodSandboxStatusRequest)(nil), "runtime.PodSandboxStatusRequest")
+	proto.RegisterType((*PodSandboxNetworkStatus)(nil), "runtime.PodSandboxNetworkStatus")
+	proto.RegisterType((*Namespace)(nil), "runtime.Namespace")
+	proto.RegisterType((*LinuxPodSandboxStatus)(nil), "runtime.LinuxPodSandboxStatus")
+	proto.RegisterType((*PodSandboxStatus)(nil), "runtime.PodSandboxStatus")
+	proto.RegisterType((*PodSandboxStatusResponse)(nil), "runtime.PodSandboxStatusResponse")
+	proto.RegisterType((*PodSandboxFilter)(nil), "runtime.PodSandboxFilter")
+	proto.RegisterType((*ListPodSandboxRequest)(nil), "runtime.ListPodSandboxRequest")
+	proto.RegisterType((*PodSandbox)(nil), "runtime.PodSandbox")
+	proto.RegisterType((*ListPodSandboxResponse)(nil), "runtime.ListPodSandboxResponse")
+	proto.RegisterType((*ImageSpec)(nil), "runtime.ImageSpec")
+	proto.RegisterType((*KeyValue)(nil), "runtime.KeyValue")
+	proto.RegisterType((*LinuxContainerResources)(nil), "runtime.LinuxContainerResources")
+	proto.RegisterType((*SELinuxOption)(nil), "runtime.SELinuxOption")
+	proto.RegisterType((*Capability)(nil), "runtime.Capability")
+	proto.RegisterType((*LinuxContainerConfig)(nil), "runtime.LinuxContainerConfig")
+	proto.RegisterType((*ContainerConfig)(nil), "runtime.ContainerConfig")
+	proto.RegisterType((*CreateContainerRequest)(nil), "runtime.CreateContainerRequest")
+	proto.RegisterType((*CreateContainerResponse)(nil), "runtime.CreateContainerResponse")
+	proto.RegisterType((*StartContainerRequest)(nil), "runtime.StartContainerRequest")
+	proto.RegisterType((*StartContainerResponse)(nil), "runtime.StartContainerResponse")
+	proto.RegisterType((*StopContainerRequest)(nil), "runtime.StopContainerRequest")
+	proto.RegisterType((*StopContainerResponse)(nil), "runtime.StopContainerResponse")
+	proto.RegisterType((*RemoveContainerRequest)(nil), "runtime.RemoveContainerRequest")
+	proto.RegisterType((*RemoveContainerResponse)(nil), "runtime.RemoveContainerResponse")
+	proto.RegisterType((*ContainerFilter)(nil), "runtime.ContainerFilter")
+	proto.RegisterType((*ListContainersRequest)(nil), "runtime.ListContainersRequest")
+	proto.RegisterType((*Container)(nil), "runtime.Container")
+	proto.RegisterType((*ListContainersResponse)(nil), "runtime.ListContainersResponse")
+	proto.RegisterType((*ContainerStatusRequest)(nil), "runtime.ContainerStatusRequest")
+	proto.RegisterType((*ContainerStatus)(nil), "runtime.ContainerStatus")
+	proto.RegisterType((*ContainerStatusResponse)(nil), "runtime.ContainerStatusResponse")
+	proto.RegisterType((*ExecRequest)(nil), "runtime.ExecRequest")
+	proto.RegisterType((*ExecResponse)(nil), "runtime.ExecResponse")
+	proto.RegisterType((*ImageFilter)(nil), "runtime.ImageFilter")
+	proto.RegisterType((*ListImagesRequest)(nil), "runtime.ListImagesRequest")
+	proto.RegisterType((*Image)(nil), "runtime.Image")
+	proto.RegisterType((*ListImagesResponse)(nil), "runtime.ListImagesResponse")
+	proto.RegisterType((*ImageStatusRequest)(nil), "runtime.ImageStatusRequest")
+	proto.RegisterType((*ImageStatusResponse)(nil), "runtime.ImageStatusResponse")
+	proto.RegisterType((*AuthConfig)(nil), "runtime.AuthConfig")
+	proto.RegisterType((*PullImageRequest)(nil), "runtime.PullImageRequest")
+	proto.RegisterType((*PullImageResponse)(nil), "runtime.PullImageResponse")
+	proto.RegisterType((*RemoveImageRequest)(nil), "runtime.RemoveImageRequest")
+	proto.RegisterType((*RemoveImageResponse)(nil), "runtime.RemoveImageResponse")
+	proto.RegisterEnum("runtime.Protocol", Protocol_name, Protocol_value)
+	proto.RegisterEnum("runtime.PodSandBoxState", PodSandBoxState_name, PodSandBoxState_value)
+	proto.RegisterEnum("runtime.ContainerState", ContainerState_name, ContainerState_value)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// Client API for RuntimeService service
+
+type RuntimeServiceClient interface {
+	// Version returns the runtime name, runtime version and runtime API version
+	Version(ctx context.Context, in *VersionRequest, opts ...grpc.CallOption) (*VersionResponse, error)
+	// CreatePodSandbox creates a pod-level sandbox.
+	// The definition of PodSandbox is at https://github.com/kubernetes/kubernetes/pull/25899
+	CreatePodSandbox(ctx context.Context, in *CreatePodSandboxRequest, opts ...grpc.CallOption) (*CreatePodSandboxResponse, error)
+	// StopPodSandbox stops the sandbox. If there are any running containers in the
+	// sandbox, they should be force terminated.
+	StopPodSandbox(ctx context.Context, in *StopPodSandboxRequest, opts ...grpc.CallOption) (*StopPodSandboxResponse, error)
+	// DeletePodSandbox deletes the sandbox. If there are any running containers in the
+	// sandbox, they should be force deleted.
+	DeletePodSandbox(ctx context.Context, in *DeletePodSandboxRequest, opts ...grpc.CallOption) (*DeletePodSandboxResponse, error)
+	// PodSandboxStatus returns the Status of the PodSandbox.
+	PodSandboxStatus(ctx context.Context, in *PodSandboxStatusRequest, opts ...grpc.CallOption) (*PodSandboxStatusResponse, error)
+	// ListPodSandbox returns a list of SandBox.
+	ListPodSandbox(ctx context.Context, in *ListPodSandboxRequest, opts ...grpc.CallOption) (*ListPodSandboxResponse, error)
+	// CreateContainer creates a new container in specified PodSandbox
+	CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
+	// StartContainer starts the container.
+	StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*StartContainerResponse, error)
+	// StopContainer stops a running container with a grace period (i.e., timeout).
+	StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*StopContainerResponse, error)
+	// RemoveContainer removes the container. If the container is running, the container
+	// should be force removed.
+	RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*RemoveContainerResponse, error)
+	// ListContainers lists all containers by filters.
+	ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error)
+	// ContainerStatus returns status of the container.
+	ContainerStatus(ctx context.Context, in *ContainerStatusRequest, opts ...grpc.CallOption) (*ContainerStatusResponse, error)
+	// Exec executes the command in the container.
+	Exec(ctx context.Context, opts ...grpc.CallOption) (RuntimeService_ExecClient, error)
+}
+
+type runtimeServiceClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewRuntimeServiceClient(cc *grpc.ClientConn) RuntimeServiceClient {
+	return &runtimeServiceClient{cc}
+}
+
+func (c *runtimeServiceClient) Version(ctx context.Context, in *VersionRequest, opts ...grpc.CallOption) (*VersionResponse, error) {
+	out := new(VersionResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/Version", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) CreatePodSandbox(ctx context.Context, in *CreatePodSandboxRequest, opts ...grpc.CallOption) (*CreatePodSandboxResponse, error) {
+	out := new(CreatePodSandboxResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/CreatePodSandbox", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StopPodSandbox(ctx context.Context, in *StopPodSandboxRequest, opts ...grpc.CallOption) (*StopPodSandboxResponse, error) {
+	out := new(StopPodSandboxResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/StopPodSandbox", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) DeletePodSandbox(ctx context.Context, in *DeletePodSandboxRequest, opts ...grpc.CallOption) (*DeletePodSandboxResponse, error) {
+	out := new(DeletePodSandboxResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/DeletePodSandbox", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) PodSandboxStatus(ctx context.Context, in *PodSandboxStatusRequest, opts ...grpc.CallOption) (*PodSandboxStatusResponse, error) {
+	out := new(PodSandboxStatusResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/PodSandboxStatus", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListPodSandbox(ctx context.Context, in *ListPodSandboxRequest, opts ...grpc.CallOption) (*ListPodSandboxResponse, error) {
+	out := new(ListPodSandboxResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/ListPodSandbox", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
+	out := new(CreateContainerResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/CreateContainer", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*StartContainerResponse, error) {
+	out := new(StartContainerResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/StartContainer", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*StopContainerResponse, error) {
+	out := new(StopContainerResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/StopContainer", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*RemoveContainerResponse, error) {
+	out := new(RemoveContainerResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/RemoveContainer", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error) {
+	out := new(ListContainersResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/ListContainers", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ContainerStatus(ctx context.Context, in *ContainerStatusRequest, opts ...grpc.CallOption) (*ContainerStatusResponse, error) {
+	out := new(ContainerStatusResponse)
+	err := grpc.Invoke(ctx, "/runtime.RuntimeService/ContainerStatus", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) Exec(ctx context.Context, opts ...grpc.CallOption) (RuntimeService_ExecClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_RuntimeService_serviceDesc.Streams[0], c.cc, "/runtime.RuntimeService/Exec", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &runtimeServiceExecClient{stream}
+	return x, nil
+}
+
+type RuntimeService_ExecClient interface {
+	Send(*ExecRequest) error
+	Recv() (*ExecResponse, error)
+	grpc.ClientStream
+}
+
+type runtimeServiceExecClient struct {
+	grpc.ClientStream
+}
+
+func (x *runtimeServiceExecClient) Send(m *ExecRequest) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *runtimeServiceExecClient) Recv() (*ExecResponse, error) {
+	m := new(ExecResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Server API for RuntimeService service
+
+type RuntimeServiceServer interface {
+	// Version returns the runtime name, runtime version and runtime API version
+	Version(context.Context, *VersionRequest) (*VersionResponse, error)
+	// CreatePodSandbox creates a pod-level sandbox.
+	// The definition of PodSandbox is at https://github.com/kubernetes/kubernetes/pull/25899
+	CreatePodSandbox(context.Context, *CreatePodSandboxRequest) (*CreatePodSandboxResponse, error)
+	// StopPodSandbox stops the sandbox. If there are any running containers in the
+	// sandbox, they should be force terminated.
+	StopPodSandbox(context.Context, *StopPodSandboxRequest) (*StopPodSandboxResponse, error)
+	// DeletePodSandbox deletes the sandbox. If there are any running containers in the
+	// sandbox, they should be force deleted.
+	DeletePodSandbox(context.Context, *DeletePodSandboxRequest) (*DeletePodSandboxResponse, error)
+	// PodSandboxStatus returns the Status of the PodSandbox.
+	PodSandboxStatus(context.Context, *PodSandboxStatusRequest) (*PodSandboxStatusResponse, error)
+	// ListPodSandbox returns a list of SandBox.
+	ListPodSandbox(context.Context, *ListPodSandboxRequest) (*ListPodSandboxResponse, error)
+	// CreateContainer creates a new container in specified PodSandbox
+	CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error)
+	// StartContainer starts the container.
+	StartContainer(context.Context, *StartContainerRequest) (*StartContainerResponse, error)
+	// StopContainer stops a running container with a grace period (i.e., timeout).
+	StopContainer(context.Context, *StopContainerRequest) (*StopContainerResponse, error)
+	// RemoveContainer removes the container. If the container is running, the container
+	// should be force removed.
+	RemoveContainer(context.Context, *RemoveContainerRequest) (*RemoveContainerResponse, error)
+	// ListContainers lists all containers by filters.
+	ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error)
+	// ContainerStatus returns status of the container.
+	ContainerStatus(context.Context, *ContainerStatusRequest) (*ContainerStatusResponse, error)
+	// Exec executes the command in the container.
+	Exec(RuntimeService_ExecServer) error
+}
+
+func RegisterRuntimeServiceServer(s *grpc.Server, srv RuntimeServiceServer) {
+	s.RegisterService(&_RuntimeService_serviceDesc, srv)
+}
+
+func _RuntimeService_Version_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(VersionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).Version(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_CreatePodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(CreatePodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).CreatePodSandbox(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_StopPodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(StopPodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).StopPodSandbox(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_DeletePodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(DeletePodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).DeletePodSandbox(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_PodSandboxStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(PodSandboxStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).PodSandboxStatus(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_ListPodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(ListPodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).ListPodSandbox(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_CreateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(CreateContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).CreateContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_StartContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(StartContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).StartContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_StopContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(StopContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).StopContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_RemoveContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(RemoveContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).RemoveContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_ListContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(ListContainersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).ListContainers(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_ContainerStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(ContainerStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(RuntimeServiceServer).ContainerStatus(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _RuntimeService_Exec_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(RuntimeServiceServer).Exec(&runtimeServiceExecServer{stream})
+}
+
+type RuntimeService_ExecServer interface {
+	Send(*ExecResponse) error
+	Recv() (*ExecRequest, error)
+	grpc.ServerStream
+}
+
+type runtimeServiceExecServer struct {
+	grpc.ServerStream
+}
+
+func (x *runtimeServiceExecServer) Send(m *ExecResponse) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *runtimeServiceExecServer) Recv() (*ExecRequest, error) {
+	m := new(ExecRequest)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+var _RuntimeService_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "runtime.RuntimeService",
+	HandlerType: (*RuntimeServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Version",
+			Handler:    _RuntimeService_Version_Handler,
+		},
+		{
+			MethodName: "CreatePodSandbox",
+			Handler:    _RuntimeService_CreatePodSandbox_Handler,
+		},
+		{
+			MethodName: "StopPodSandbox",
+			Handler:    _RuntimeService_StopPodSandbox_Handler,
+		},
+		{
+			MethodName: "DeletePodSandbox",
+			Handler:    _RuntimeService_DeletePodSandbox_Handler,
+		},
+		{
+			MethodName: "PodSandboxStatus",
+			Handler:    _RuntimeService_PodSandboxStatus_Handler,
+		},
+		{
+			MethodName: "ListPodSandbox",
+			Handler:    _RuntimeService_ListPodSandbox_Handler,
+		},
+		{
+			MethodName: "CreateContainer",
+			Handler:    _RuntimeService_CreateContainer_Handler,
+		},
+		{
+			MethodName: "StartContainer",
+			Handler:    _RuntimeService_StartContainer_Handler,
+		},
+		{
+			MethodName: "StopContainer",
+			Handler:    _RuntimeService_StopContainer_Handler,
+		},
+		{
+			MethodName: "RemoveContainer",
+			Handler:    _RuntimeService_RemoveContainer_Handler,
+		},
+		{
+			MethodName: "ListContainers",
+			Handler:    _RuntimeService_ListContainers_Handler,
+		},
+		{
+			MethodName: "ContainerStatus",
+			Handler:    _RuntimeService_ContainerStatus_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Exec",
+			Handler:       _RuntimeService_Exec_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+}
+
+// Client API for ImageService service
+
+type ImageServiceClient interface {
+	// ListImages lists existing images.
+	ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error)
+	// ImageStatus returns the status of the image.
+	ImageStatus(ctx context.Context, in *ImageStatusRequest, opts ...grpc.CallOption) (*ImageStatusResponse, error)
+	// PullImage pulls a image with authentication config.
+	PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (*PullImageResponse, error)
+	// RemoveImage removes the image.
+	RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error)
+}
+
+type imageServiceClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewImageServiceClient(cc *grpc.ClientConn) ImageServiceClient {
+	return &imageServiceClient{cc}
+}
+
+func (c *imageServiceClient) ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error) {
+	out := new(ListImagesResponse)
+	err := grpc.Invoke(ctx, "/runtime.ImageService/ListImages", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) ImageStatus(ctx context.Context, in *ImageStatusRequest, opts ...grpc.CallOption) (*ImageStatusResponse, error) {
+	out := new(ImageStatusResponse)
+	err := grpc.Invoke(ctx, "/runtime.ImageService/ImageStatus", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (*PullImageResponse, error) {
+	out := new(PullImageResponse)
+	err := grpc.Invoke(ctx, "/runtime.ImageService/PullImage", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error) {
+	out := new(RemoveImageResponse)
+	err := grpc.Invoke(ctx, "/runtime.ImageService/RemoveImage", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// Server API for ImageService service
+
+type ImageServiceServer interface {
+	// ListImages lists existing images.
+	ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error)
+	// ImageStatus returns the status of the image.
+	ImageStatus(context.Context, *ImageStatusRequest) (*ImageStatusResponse, error)
+	// PullImage pulls a image with authentication config.
+	PullImage(context.Context, *PullImageRequest) (*PullImageResponse, error)
+	// RemoveImage removes the image.
+	RemoveImage(context.Context, *RemoveImageRequest) (*RemoveImageResponse, error)
+}
+
+func RegisterImageServiceServer(s *grpc.Server, srv ImageServiceServer) {
+	s.RegisterService(&_ImageService_serviceDesc, srv)
+}
+
+func _ImageService_ListImages_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(ListImagesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(ImageServiceServer).ListImages(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _ImageService_ImageStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(ImageStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(ImageServiceServer).ImageStatus(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _ImageService_PullImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(PullImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(ImageServiceServer).PullImage(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func _ImageService_RemoveImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
+	in := new(RemoveImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	out, err := srv.(ImageServiceServer).RemoveImage(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+var _ImageService_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "runtime.ImageService",
+	HandlerType: (*ImageServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListImages",
+			Handler:    _ImageService_ListImages_Handler,
+		},
+		{
+			MethodName: "ImageStatus",
+			Handler:    _ImageService_ImageStatus_Handler,
+		},
+		{
+			MethodName: "PullImage",
+			Handler:    _ImageService_PullImage_Handler,
+		},
+		{
+			MethodName: "RemoveImage",
+			Handler:    _ImageService_RemoveImage_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{},
+}

pkg/kubelet/api/v1alpha1/runtime/api.proto

+// api.pb.go could be generate by hack/update-generate-runtime.sh
+syntax = 'proto2';
+
+package runtime;
+
+// Runtime service defines the public APIs for remote container runtimes
+service RuntimeService {
+    // Version returns the runtime name, runtime version and runtime API version
+    rpc Version(VersionRequest) returns (VersionResponse) {}
+
+    // CreatePodSandbox creates a pod-level sandbox.
+    // The definition of PodSandbox is at https://github.com/kubernetes/kubernetes/pull/25899
+    rpc CreatePodSandbox(CreatePodSandboxRequest) returns (CreatePodSandboxResponse) {}
+    // StopPodSandbox stops the sandbox. If there are any running containers in the
+    // sandbox, they should be force terminated.
+    rpc StopPodSandbox(StopPodSandboxRequest) returns (StopPodSandboxResponse) {}
+    // DeletePodSandbox deletes the sandbox. If there are any running containers in the
+    // sandbox, they should be force deleted.
+    rpc DeletePodSandbox(DeletePodSandboxRequest) returns (DeletePodSandboxResponse) {}
+    // PodSandboxStatus returns the Status of the PodSandbox.
+    rpc PodSandboxStatus(PodSandboxStatusRequest) returns (PodSandboxStatusResponse) {}
+    // ListPodSandbox returns a list of SandBox.
+    rpc ListPodSandbox(ListPodSandboxRequest) returns (ListPodSandboxResponse) {}
+
+    // CreateContainer creates a new container in specified PodSandbox
+    rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
+    // StartContainer starts the container.
+    rpc StartContainer(StartContainerRequest) returns (StartContainerResponse) {}
+    // StopContainer stops a running container with a grace period (i.e., timeout).
+    rpc StopContainer(StopContainerRequest) returns (StopContainerResponse) {}
+    // RemoveContainer removes the container. If the container is running, the container
+    // should be force removed.
+    rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse) {}
+    // ListContainers lists all containers by filters.
+    rpc ListContainers(ListContainersRequest) returns (ListContainersResponse) {}
+    // ContainerStatus returns status of the container.
+    rpc ContainerStatus(ContainerStatusRequest) returns (ContainerStatusResponse) {}
+
+    // Exec executes the command in the container.
+    rpc Exec(stream ExecRequest) returns (stream ExecResponse) {}
+}
+
+// Image service defines the public APIs for managing images
+service ImageService {
+    // ListImages lists existing images.
+    rpc ListImages(ListImagesRequest) returns (ListImagesResponse) {}
+    // ImageStatus returns the status of the image.
+    rpc ImageStatus(ImageStatusRequest) returns (ImageStatusResponse) {}
+    // PullImage pulls a image with authentication config.
+    rpc PullImage(PullImageRequest) returns (PullImageResponse) {}
+    // RemoveImage removes the image.
+    rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse) {}
+}
+
+message VersionRequest {
+    // The version of kubelet runtime API.
+    optional string version = 1;
+}
+
+message VersionResponse {
+    // The version of the kubelet runtime API.
+    optional string version = 1;
+    // The name of the container runtime.
+    optional string runtime_name = 2;
+    // The version of the container runtime.
+    optional string runtime_version = 3;
+    // The API version of the container runtime.
+    optional string runtime_api_version = 4;
+}
+
+// DNSOption specifies the DNS servers and search domains.
+message DNSOption {
+    // List of DNS servers of the cluster.
+    repeated string servers = 1;
+    // List of DNS search domains of the cluster.
+    repeated string searches = 2;
+}
+
+enum Protocol {
+    TCP = 0;
+    UDP = 1;
+}
+
+// PortMapping specifies the port mapping configurations of sandbox
+message PortMapping {
+    // The name of the port mapping
+    optional string name = 1;
+    // The protocol of the port mapping.
+    optional Protocol protocol = 2;
+    // The port number within the container.
+    optional int32 container_port = 3;
+    // The port number on the host.
+    optional int32 host_port = 4;
+    // The host IP.
+    optional string host_ip = 5;
+}
+
+// Mount specifies the volume mount for the sandbox
+message Mount {
+    // The name of the volume mount.
+    optional string name = 1;
+    // The path of the mount within the container.
+    optional string container_path = 2;
+    // The path of the mount on the host.
+    optional string host_path = 3;
+    // If set, the mount is read-only.
+    optional bool readonly = 4;
+    // If set, the mount needs SELinux relabeling
+    optional bool selinux_relabel = 5;
+}
+
+// ResourceRequirements contains a set of resources
+// Valid resources are:
+// - cpu, in cores. (500m = .5 cores)
+// - memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
+message ResourceRequirements {
+    // The maximum amount of compute resources allowed.
+    optional double limits = 1;
+    // The minimum amount of compute resources required.
+    // If Request is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value
+    optional double requests = 2;
+}
+
+// PodSandboxResources contains the CPU/memory resource requirements.
+message PodSandboxResources {
+    // CPU resource requirement.
+    optional ResourceRequirements cpu = 1;
+    // Memory resource requirement.
+    optional ResourceRequirements memory = 2;
+}
+
+// NamespaceOption provides options for Linux namespaces.
+message NamespaceOption {
+    // If set, use the host's network namespace.
+    optional bool host_network = 1;
+    // If set, use the host's pid namesapce.
+    optional bool host_pid = 2;
+    // If set, use the host's ipc namespace.
+    optional bool host_ipc = 3;
+}
+
+// LinuxPodSandboxConfig holds platform-specific configuraions for Linux
+// host platforms and Linux-based containers.
+message LinuxPodSandboxConfig {
+    // The parent cgroup of the pod sandbox.
+    // The cgroupfs style syntax will be used, but the container runtime can 
+    // convert it to systemd semantices if needed.
+    optional string cgroup_parent = 1;
+    // The configurations for the sandbox's namespaces.
+    // This will be used only if the PodSandbox uses namespace for isolation.
+    optional NamespaceOption namespace_options = 2;
+}
+
+// PodSandboxConfig holds all the required and optional fields for creating a
+// sandbox.
+message PodSandboxConfig {
+    // The name of the sandbox.
+    optional string name = 1;
+    // The hostname of the sandbox.
+    optional string hostname = 2;
+    // Path to the directory on the host in which container log files are
+    // stored.
+    // By default the log of a container going into the LogDirectory will be
+    // hooked up to STDOUT and STDERR. However, the LogDirectory may contain
+    // binary log files with structured logging data from the individual
+    // containers. For example the files might be newline seperated JSON
+    // structured logs, systemd-journald journal files, gRPC trace files, etc.
+    // E.g.,
+    //     PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/`
+    //     ContainerConfig.LogPath = `containerName_Instance#.log`
+    //
+    // WARNING: Log managment and how kubelet should interface with the
+    // container logs are under active discussion in
+    // https://issues.k8s.io/24677. There *may* be future change of direction
+    // for logging as the discussion carries on.
+    optional string log_directory = 3;
+    // The DNS options for the sandbox.
+    optional DNSOption dns_options = 4;
+    // The port mappings for the sandbox.
+    repeated PortMapping port_mappings = 5;
+    // Resources specifies the resource limits for the sandbox (i.e., the
+    // aggregate cpu/memory resources limits of all containers).
+    // Note: On a Linux host, kubelet will create a pod-level cgroup and pass
+    // it as the cgroup parent for the PodSandbox. For some runtimes, this is
+    // sufficent. For others, e.g., hypervisor-based runtimes, explicit
+    // resource limits for the sandbox are needed at creation time.
+    optional PodSandboxResources resources  = 6;
+    // Labels are key value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 7;
+    // Annotations is an unstructured key value map that may be set by external
+    // tools to store and retrieve arbitrary metadata.
+    map<string, string> annotations = 8;
+    // Optional configurations specific to Linux hosts.
+    optional LinuxPodSandboxConfig linux = 9;
+}
+
+message CreatePodSandboxRequest {
+    // The configuration for creating a PodSandBox.
+    optional PodSandboxConfig config = 1;
+}
+
+message CreatePodSandboxResponse {
+    // The id of the PodSandBox
+    optional string pod_sandbox_id = 1;
+}
+
+message StopPodSandboxRequest {
+    // The id of the PodSandBox
+    optional string pod_sandbox_id = 1;
+}
+
+message StopPodSandboxResponse {}
+
+message DeletePodSandboxRequest {
+    // The id of the PodSandBox
+    optional string pod_sandbox_id = 1;
+}
+
+message DeletePodSandboxResponse {}
+
+message PodSandboxStatusRequest {
+    // The id of the PodSandBox
+    optional string pod_sandbox_id = 1;
+}
+
+// PodSandboxNetworkStatus is the status of the network for a PodSandbox.
+message PodSandboxNetworkStatus {
+    // The IP address of the PodSandbox
+    optional string ip = 1;
+}
+
+// Namespace contains paths to the namespaces.
+message Namespace {
+    // Network is the path to the network namespace.
+    optional string network = 1;
+    // Options is the namespace options for linux namespaces
+    optional NamespaceOption options = 2;
+}
+
+// LinuxSandBoxStatus contains status specific to Linux sandboxes.
+message LinuxPodSandboxStatus {
+    // Namespaces contains paths to the sandbox's namespaces.
+    optional Namespace namespaces = 1;
+}
+
+enum PodSandBoxState {
+    READY = 0;
+    NOTREADY = 1;
+}
+
+// PodSandboxStatus contains the status of the PodSandbox.
+message PodSandboxStatus {
+    // ID of the sandbox.
+    optional string id = 1;
+    // Name of the sandbox
+    optional string name = 2;
+    // State of the sandbox.
+    optional PodSandBoxState state = 3;
+    // Creation timestamp of the sandbox
+    optional int64 created_at = 4;
+    // Network contains network status if network is handled by the runtime.
+    optional PodSandboxNetworkStatus network = 5;
+    // Linux specific status to a pod sandbox.
+    optional LinuxPodSandboxStatus linux = 6;
+    // Labels are key value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 7;
+    // Annotations is an unstructured key value map that may be set by external
+    // tools to store and retrieve arbitrary metadata.
+    map<string, string> annotations = 8;
+}
+
+message PodSandboxStatusResponse {
+    // The status of the PodSandbox
+    optional PodSandboxStatus status = 1;
+}
+
+// PodSandboxFilter is used to filter a list of PodSandboxes.
+// All those fields are combined with 'AND'
+message PodSandboxFilter {
+    // Name of the sandbox.
+    optional string name = 1;
+    // ID of the sandbox.
+    optional string id = 2;
+    // State of the sandbox.
+    optional PodSandBoxState state = 3;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 4;
+}
+
+message ListPodSandboxRequest {
+    // PodSandboxFilter to filter a list of PodSandboxes.
+    optional PodSandboxFilter filter = 1;
+}
+
+
+// PodSandbox contains minimal information about a sandbox.
+message PodSandbox {
+    // The id of the PodSandbox
+    optional string id = 1;
+    // The name of the PodSandbox
+    optional string name = 2;
+    // The state of the PodSandbox
+    optional PodSandBoxState state = 3;
+    // Creation timestamps of the sandbox
+    optional int64 created_at = 4;
+    // The labels of the PodSandbox
+    map<string, string> labels = 5;
+}
+
+message ListPodSandboxResponse {
+    // List of PodSandbox
+    repeated PodSandbox items = 1;
+}
+
+// ImageSpec is an internal representation of an image.  Currently, it wraps the
+// value of a Container's Image field (e.g. imageName, imageName:tag, or 
+// imageName:digest), but in the future it will include more detailed 
+// information about the different image types.
+message ImageSpec {
+    optional string image = 1;
+}
+
+message KeyValue {
+    optional string key = 1;
+    optional string value = 2;
+}
+
+// LinuxContainerResources specifies Linux specific configuration for
+// resources.
+// TODO: Consider using Resources from opencontainers/runtime-spec/specs-go
+// directly.
+message LinuxContainerResources {
+    // CPU CFS (Completely Fair Scheduler) period
+    optional int64 cpu_period = 1;
+    // CPU CFS (Completely Fair Scheduler) quota
+    optional int64 cpu_quota = 2;
+    // CPU shares (relative weight vs. other containers)
+    optional int64 cpu_shares = 3;
+    // Memory limit in bytes
+    optional int64 memory_limit_in_bytes = 4;
+    // OOMScoreAdj adjusts the oom-killer score.
+    optional int64 oom_score_adj = 5;
+}
+
+// SELinuxOption are the labels to be applied to the container.
+message SELinuxOption {
+    optional string user = 1;
+    optional string role = 2;
+    optional string type = 3;
+    optional string level = 4;
+}
+
+// Capability contains the container capabilities to add or drop
+message Capability {
+    // List of capabilities to add.
+    repeated string add_capabilities = 1;
+    // List of capabilities to drop.
+    repeated string drop_capabilities = 2;
+}
+
+// LinuxContainerConfig contains platform-specific configuration for
+// Linux-based containers.
+message LinuxContainerConfig {
+    // Resources specification for the container.
+    optional LinuxContainerResources resources = 1;
+    // Capabilities to add or drop.
+    optional Capability capabilities = 2;
+    // Optional SELinux context to be applied.
+    optional SELinuxOption selinux_options = 3;
+}
+
+message ContainerConfig {
+    // Name of the container.
+    optional string name = 1;
+    // Image to use.
+    optional ImageSpec image = 2;
+    // Command to execute (i.e., entrypoint for docker)
+    repeated string command = 3;
+    // Args for the Command (i.e., command for docker)
+    repeated string args = 4;
+    // Current working directory of the command.
+    optional string working_dir = 5;
+    // List of environment variable to set in the container
+    repeated KeyValue envs = 6;
+    // Mounts specifies mounts for the container
+    repeated Mount mounts = 7;
+    // Labels are key value pairs that may be used to scope and select individual resources.
+    // Label keys are of the form:
+    //     label-key ::= prefixed-name | name
+    //     prefixed-name ::= prefix '/' name
+    //     prefix ::= DNS_SUBDOMAIN
+    //     name ::= DNS_LABEL
+    map<string, string> labels = 8;
+    // Annotations is an unstructured key value map that may be set by external
+    // tools to store and retrieve arbitrary metadata.
+    map<string, string> annotations = 9;
+    // If set, run container in privileged mode.
+    // Processes in privileged containers are essentially equivalent to root on the host.
+    optional bool privileged = 10;
+    // If set, the root filesystem of the container is read-only.
+    optional bool readonly_rootfs = 11;
+    // Path relative to PodSandboxConfig.LogDirectory for container to store
+    // the log (STDOUT and STDERR) on the host.
+    // E.g.,
+    //     PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/`
+    //     ContainerConfig.LogPath = `containerName_Instance#.log`
+    //
+    // WARNING: Log managment and how kubelet should interface with the
+    // container logs are under active discussion in
+    // https://issues.k8s.io/24677. There *may* be future change of direction
+    // for logging as the discussion carries on.
+    optional string log_path = 12;
+    // The hash of container config
+
+    // Variables for interactive containers, these have very specialized
+    // use-cases (e.g. debugging).
+    // TODO: Determine if we need to continue supporting these fields that are
+    // part of Kubernetes's Container Spec.
+    optional bool stdin = 13;
+    optional bool stdin_once = 14;
+    optional bool tty = 15;
+
+    // Linux contains configuration specific to Linux containers.
+    optional LinuxContainerConfig linux = 16;
+}
+
+message CreateContainerRequest {
+    // The id of the PodSandbox
+    optional string pod_sandbox_id = 1;
+    // The config of the container
+    optional ContainerConfig config = 2;
+    // The config of the PodSandbox
+    optional PodSandboxConfig sandbox_config = 3;
+}
+
+message CreateContainerResponse {
+    // The id of the created container
+    optional string container_id = 1;
+}
+
+message StartContainerRequest {
+    // The id of the container
+    optional string container_id = 1;
+}
+
+message StartContainerResponse {}
+
+message StopContainerRequest {
+    // The id of the container
+    optional string container_id = 1;
+    // Timeout in seconds to stop the container
+    optional int64 timeout = 2;
+}
+
+message StopContainerResponse {}
+
+message RemoveContainerRequest {
+    // The id of the container
+    optional string container_id = 1;
+}
+
+message RemoveContainerResponse {}
+
+enum ContainerState {
+    CREATED = 0;
+    RUNNING = 1;
+    EXITED  = 2;
+    UNKNOWN = 3;
+}
+
+// ContainerFilter is used to filter containers.
+// All those fields are combined with 'AND'
+message ContainerFilter {
+    // Name of the container.
+    optional string name = 1;
+    // ID of the container.
+    optional string id = 2;
+    // State of the contianer.
+    optional ContainerState state = 3;
+    // The id of the pod sandbox
+    optional string pod_sandbox_id = 4;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 5;
+}
+
+message ListContainersRequest {
+    optional ContainerFilter filter = 1;
+}
+
+// Container provides the runtime information for a container, such as ID, hash,
+// state of the container.
+message Container {
+    // The ID of the container, used by the container runtime to identify
+    // a container.
+    optional string id = 1;
+    // The name of the container
+    optional string name = 2;
+     // The spec of the image
+    optional ImageSpec image = 3;
+    // Reference to the image in use. For most runtimes, this should be an
+    // image ID.
+    optional string image_ref = 4;
+    // State is the state of the container.
+    optional ContainerState state = 5;
+    // Labels are key value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 6;
+}
+
+message ListContainersResponse {
+    // List of containers
+    repeated Container containers = 1;
+}
+
+message ContainerStatusRequest {
+    // The id of the container
+    optional string container_id = 1;
+}
+
+// ContainerStatus represents the status of a container.
+message ContainerStatus {
+    // ID of the container.
+    optional string id = 1;
+    // Name of the container.
+    optional string name = 2;
+    // Status of the container.
+    optional ContainerState state = 3;
+    // Creation time of the container.
+    optional int64 created_at = 4;
+    // Start time of the container.
+    optional int64 started_at = 5;
+    // Finish time of the container.
+    optional int64 finished_at = 6;
+    // Exit code of the container.
+    optional int32 exit_code = 7;
+     // The spec of the image
+    optional ImageSpec image = 8;
+    // Reference to the image in use. For most runtimes, this should be an
+    // image ID
+    optional string image_ref = 9;
+    // A string explains why container is in such a status.
+    optional string reason = 10;
+    // Labels are key value pairs that may be used to scope and select individual resources.
+    map<string,string> labels = 11;
+    // Annotations is an unstructured key value map.
+    map<string,string> annotations = 12;
+    // Mounts specifies mounts for the container
+    repeated Mount mounts = 13;
+}
+
+message ContainerStatusResponse {
+    // The status of the container
+    optional ContainerStatus status = 1;
+}
+
+message ExecRequest {
+    // The id of the container
+    optional string container_id = 1;
+    // The cmd to execute
+    repeated string cmd = 2;
+    // Whether use tty
+    optional bool tty = 3;
+    // Streaming stdin
+    optional bytes stdin = 4;
+}
+
+message ExecResponse {
+    // Streaming stdout
+    optional bytes stdout = 1;
+    // Streaming stderr
+    optional bytes stderr = 2;
+}
+
+message ImageFilter {
+    // The spec of the image
+    optional ImageSpec image = 1;
+}
+
+message ListImagesRequest {
+    // The filter to list images
+    optional ImageFilter filter = 1;
+}
+
+// Basic information about a container image.
+message Image {
+    // ID of the image.
+    optional string id = 1;
+    // Other names by which this image is known.
+    repeated string repo_tags = 2;
+    // Digests by which this image is known.
+    repeated string repo_digests = 3;
+    // The size of the image in bytes.
+    optional uint64 size = 4;
+}
+
+message ListImagesResponse {
+    // List of images
+    repeated Image images = 1;
+}
+
+message ImageStatusRequest {
+    // The spec of the image
+    optional ImageSpec image = 1;
+}
+
+message ImageStatusResponse {
+    // The status of the image
+    optional Image image = 1;
+}
+
+// AuthConfig contains authorization information for connecting to a registry.
+message AuthConfig {
+    optional string username = 1;
+    optional string password = 2;
+    optional string auth = 3;
+    optional string server_address = 4;
+    // IdentityToken is used to authenticate the user and get
+    // an access token for the registry.
+    optional string identity_token = 5;
+    // RegistryToken is a bearer token to be sent to a registry
+    optional string registry_token = 6;
+}
+
+message PullImageRequest {
+    // The spec of the image
+    optional ImageSpec image = 1;
+    // The auth config for pulling image
+    optional AuthConfig auth = 2;
+    // The config of the PodSandbox, which is used to pull image in PodSandbox context
+    optional PodSandboxConfig sandbox_config = 3;
+}
+
+message PullImageResponse {}
+
+message RemoveImageRequest {
+    // The spec of the image
+    optional ImageSpec image = 1;
+}
+
+message RemoveImageResponse {}