CRA Class II: Container Runtimes Impact

Class II: The Highest Bar for Containers

Container runtimes (Docker, containerd, CRI-O) and hypervisors (KVM, VMware, Hyper-V) are classified as Important Products Class II under the CRA. This means potential third-party conformity assessment — the most rigorous compliance tier before Critical products.

Why Class II?

Container runtimes and hypervisors provide the isolation boundary between workloads. A vulnerability here compromises everything running on top. The CRA recognizes this elevated risk.

ETSI EN 304 635: Hypervisors and Container Runtime Systems

This standard covers:

• Type 1 and Type 2 hypervisors
• Container runtimes (Docker Engine, containerd, CRI-O, Podman)
• Container orchestration platforms (when bundled as a product)
• Virtual machine monitors

Requirements

Security Isolation

- Process isolation between containers/VMs must resist escape attacks
- Memory isolation must prevent cross-tenant data leaks
- Network isolation must enforce per-workload policies
- Storage isolation must prevent unauthorized access

Vulnerability Management

• CVE response within 24 hours for actively exploited vulnerabilities
• Regular security updates for the runtime lifecycle
• SBOM for all bundled components

Conformity Assessment Options

For Class II products, manufacturers can either:

1. Use harmonized standards (EN 304 635) — self-assessment allowed if standards are applied
2. Third-party assessment — required if not following harmonized standards

Impact on Kubernetes Platforms

If you sell a Kubernetes distribution or managed Kubernetes:

Your Product Stack → CRA Classification:
├── Container Runtime (containerd) → Class II
├── Kubernetes Control Plane → Depends on product positioning
├── Networking (Cilium/Calico) → May fall under networking standards
├── Storage (CSI drivers) → Part of the product's digital elements
└── Your Application Layer → Default or Class I depending on function

Key question: If you bundle containerd into your product, do YOU become the manufacturer responsible for Class II compliance?

Answer: Yes, if you’re the entity placing the product on the market. You inherit the containerd compliance obligation.

Practical Steps

1. Audit your runtime stack — identify all components that constitute “container runtime” in your product
2. Engage with ETSI — follow EN 304 635 development for specific requirements
3. Assess third-party needs — determine if you can use harmonized standards or need external assessment
4. Harden your runtime — seccomp profiles, AppArmor/SELinux, rootless containers
5. Document extensively — technical documentation is mandatory for all CRA products

Running container platforms that may fall under CRA Class II? I help organizations assess and prepare for compliance. Get in touch.