CNI: The Universal Plug for Container Networking
CNI is the standard API that decouples container runtimes from network implementations. In Kubernetes, it lets you swap networking plugins like Calico or Flannel.
Why it exists
Before CNI, container runtimes had their own tightly-coupled networking models. This made it difficult to swap out networking solutions or innovate independently. A standard was needed to decouple the runtime (which creates and runs containers) from the network implementation (which connects them).
The mental model
CNI is a specification, not an implementation. It's a contract between a container runtime and a networking plugin. Think of it like a USB standard for networking: the runtime doesn't need to know the specifics of a network, only how to talk to the CNI interface. The CNI plugin you install handles all the details of its specific network technology.
How it works
When a container is created, the container runtime (e.g., containerd in Kubernetes) executes a CNI plugin binary. The runtime passes configuration and the container's network namespace details to the plugin. The plugin then performs the necessary actions—like creating a virtual ethernet pair, assigning an IP address, and setting up routes. It returns the result to the runtime as JSON. When the container is deleted, the runtime calls the plugin again to tear down the network and clean up all allocated resources.
When to use it
CNI is the de facto standard for networking in Kubernetes environments. The kubelet invokes a CNI plugin to provide network connectivity for pods. This allows operators to choose from a wide range of networking solutions (like Calico, Cilium, or Flannel) based on their requirements for performance, security, or policy enforcement, without changing the orchestrator itself.
When not to use it
If you are running a simple, single-host setup with a tool like Docker Desktop, you'll likely use its built-in networking, which does not use CNI by default. CNI's primary value is in orchestrated, multi-host environments where network pluggability and interoperability are key requirements. For simple local development, it's often overkill.
One canonical example
A Kubernetes cluster administrator installs the Cilium CNI plugin on all nodes. When the kubelet on a node needs to start a new pod, it calls the Cilium CNI binary. Cilium assigns an IP address, uses eBPF to efficiently wire up the pod's networking within the host's kernel, and applies any relevant NetworkPolicies. The kubelet itself remains completely unaware of Cilium's eBPF-based implementation details.
Interview question
What is the fundamental role of CNI in a container orchestration system like Kubernetes?
- a.To replace the need for separate container runtimes by integrating networking directly into the orchestrator.
- b.To manage the entire lifecycle of network policies and firewall rules for all containers.
- c.To offer a default, high-performance network solution that all container runtimes can directly utilize.
- d.To provide a standardized interface for container runtimes to interact with various network implementations.Correct
Why? this is the answer
CNI's core purpose is to provide a standardized API (specification) that allows container runtimes to interact with diverse networking plugins, enabling network solution flexibility. While some CNI plugins can manage network policies, CNI itself is the interface that enables such plugins, not the policy manager itself.
Just read this? Test yourself on what you have been reading.
Read the original → cni.dev
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on networking — each one lists the topics its interview covers.
See open roles