Can you walk me through the low-level container runtime stack (runc, containerd, CRI-O)? What actually happens under the hood when 'docker run' executes?

Docker does not run containers directly; it delegates execution to specialized runtimes:

• dockerd: The high-level daemon that manages API commands, networks, images, and builds.
• containerd: A CNCF graduated project that manages the container lifecycle (transfers images, manages storage, supervises execution).
• runc: The low-level runtime that communicates directly with the Linux kernel to configure namespaces and cgroups, starts the container process, and exits.
• CRI-O: A lightweight alternative to containerd designed specifically for Kubernetes (CRI compliant) to run containers directly via runc.