I don't really agree (I'm one of the developers of ocid / cri-o). Even with a container-manager-as-init you still need to administer your control plane (updates

I don't really agree (I'm one of the developers of ocid / cri-o). Even with a container-manager-as-init you still need to administer your control plane (updates, configuration, so on). Now, you could go the CoreOS way of creating an "administration 'container'" which bindmounts / to somewhere inside the container -- that works but I would still consider it to not be any different from ssh-ing into the machine as root (it removes the need for sshd and means that you can manage the server through the same tooling you manage containers with, but the purpose is the same -- give you a general purpose OS environment you can use to administer things). Not to mention that your actual containers will still contain general purpose OS images. Also, as an aside, cri-o would be a very bad choice for PID 1. It's specifically designed so that you don't need it to be a long-running daemon (which is something that Docker cannot do and is actually a very useful feature that we hope to keep). And you can't have your PID 1 just exit whenever it wants to.