diff --git a/core/internal/containerd/BUILD.bazel b/core/internal/containerd/BUILD.bazel
new file mode 100644
index 0000000..dd7cf6d
--- /dev/null
+++ b/core/internal/containerd/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "git.monogon.dev/source/nexantic.git/core/internal/containerd",
+    visibility = ["//core:__subpackages__"],
+    deps = [
+        "//core/pkg/logbuffer:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
+    ],
+)
+
+exports_files([
+    "config.toml",
+    "runsc.toml",
+    "loopback.json",
+    "ptp.json",
+])
diff --git a/core/internal/containerd/config.toml b/core/internal/containerd/config.toml
new file mode 100644
index 0000000..86ef097
--- /dev/null
+++ b/core/internal/containerd/config.toml
@@ -0,0 +1,118 @@
+version = 2
+root = "/data/containerd"
+state = "/containerd/run"
+plugin_dir = ""
+disabled_plugins = []
+required_plugins = []
+oom_score = 0
+
+[grpc]
+  address = "/containerd/run/containerd.sock"
+  tcp_address = ""
+  tcp_tls_cert = ""
+  tcp_tls_key = ""
+  uid = 0
+  gid = 0
+  max_recv_message_size = 16777216
+  max_send_message_size = 16777216
+
+[ttrpc]
+  address = ""
+  uid = 0
+  gid = 0
+
+[debug]
+  address = ""
+  uid = 0
+  gid = 0
+  level = ""
+
+[metrics]
+  address = ""
+  grpc_histogram = false
+
+[cgroup]
+  path = ""
+
+[timeouts]
+  "io.containerd.timeout.shim.cleanup" = "5s"
+  "io.containerd.timeout.shim.load" = "5s"
+  "io.containerd.timeout.shim.shutdown" = "3s"
+  "io.containerd.timeout.task.state" = "2s"
+
+[plugins]
+  [plugins."io.containerd.gc.v1.scheduler"]
+    pause_threshold = 0.02
+    deletion_threshold = 0
+    mutation_threshold = 100
+    schedule_delay = "0s"
+    startup_delay = "100ms"
+  [plugins."io.containerd.grpc.v1.cri"]
+    disable_tcp_service = true
+    stream_server_address = "127.0.0.1"
+    stream_server_port = "0"
+    stream_idle_timeout = "4h0m0s"
+    enable_selinux = false
+    sandbox_image = "k8s.gcr.io/pause:3.1"
+    stats_collect_period = 10
+    systemd_cgroup = false
+    enable_tls_streaming = false
+    max_container_log_line_size = 16384
+    disable_cgroup = false
+    disable_apparmor = true
+    restrict_oom_score_adj = false
+    max_concurrent_downloads = 3
+    disable_proc_mount = false
+    [plugins."io.containerd.grpc.v1.cri".containerd]
+      snapshotter = "overlayfs"
+      default_runtime_name = "runsc"
+      no_pivot = false
+      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
+        runtime_type = ""
+        runtime_engine = ""
+        runtime_root = ""
+        privileged_without_host_devices = false
+      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
+        runtime_type = ""
+        runtime_engine = ""
+        runtime_root = ""
+        privileged_without_host_devices = false
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
+          runtime_type = "io.containerd.runsc.v1"
+          runtime_engine = ""
+          runtime_root = ""
+          privileged_without_host_devices = false
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc.options]
+            TypeUrl = "io.containerd.runsc.v1.options"
+            ConfigPath = "/containerd/conf/runsc.toml"
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/containerd/bin/cni"
+      conf_dir = "/containerd/conf/cni"
+      max_conf_num = 1
+      conf_template = ""
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
+        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
+          endpoint = ["https://registry-1.docker.io"]
+    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
+      tls_cert_file = ""
+      tls_key_file = ""
+  [plugins."io.containerd.internal.v1.opt"]
+    path = "/containerd/bin"
+  [plugins."io.containerd.internal.v1.restart"]
+    interval = "10s"
+  [plugins."io.containerd.metadata.v1.bolt"]
+    content_sharing_policy = "shared"
+  [plugins."io.containerd.monitor.v1.cgroups"]
+    no_prometheus = false
+  [plugins."io.containerd.runtime.v1.linux"]
+    shim = "containerd-shim"
+    runtime = "noop"
+    runtime_root = ""
+    no_shim = false
+    shim_debug = false
+  [plugins."io.containerd.runtime.v2.task"]
+    platforms = ["linux/amd64"]
+  [plugins."io.containerd.service.v1.diff-service"]
+    default = ["walking"]
\ No newline at end of file
diff --git a/core/internal/containerd/loopback.json b/core/internal/containerd/loopback.json
new file mode 100644
index 0000000..f375c5d
--- /dev/null
+++ b/core/internal/containerd/loopback.json
@@ -0,0 +1,4 @@
+{
+  "cniVersion": "0.3.0",
+  "type": "loopback"
+}
diff --git a/core/internal/containerd/main.go b/core/internal/containerd/main.go
new file mode 100644
index 0000000..f4952e4
--- /dev/null
+++ b/core/internal/containerd/main.go
@@ -0,0 +1,48 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package containerd
+
+import (
+	"context"
+	"os"
+	"os/exec"
+
+	"git.monogon.dev/source/nexantic.git/core/pkg/logbuffer"
+
+	"golang.org/x/sys/unix"
+)
+
+// Implements supervisor.Runnable for later integration
+
+func RunContainerd(ctx context.Context) error {
+	containerdLog := logbuffer.New(1000, 16384)
+	cmd := exec.CommandContext(ctx, "/containerd/bin/containerd", "--config", "/containerd/conf/config.toml")
+	cmd.Stdout = containerdLog
+	cmd.Stderr = containerdLog
+	cmd.Env = []string{"PATH=/containerd/bin", "TMPDIR=/containerd/run/tmp"}
+
+	if err := unix.Mount("tmpfs", "/containerd/run", "tmpfs", 0, ""); err != nil {
+		panic(err)
+	}
+	if err := os.MkdirAll("/containerd/run/tmp", 0755); err != nil {
+		panic(err)
+	}
+
+	// TODO(lorenz): Healthcheck against cri.Status() RPC
+
+	return cmd.Run()
+}
diff --git a/core/internal/containerd/ptp.json b/core/internal/containerd/ptp.json
new file mode 100644
index 0000000..d95da5d
--- /dev/null
+++ b/core/internal/containerd/ptp.json
@@ -0,0 +1,12 @@
+{
+  "name": "k8s-pod-network",
+  "cniVersion": "0.3.1",
+  "type": "ptp",
+  "mtu": 1420,
+  "ipam": {
+    "type": "host-local",
+    "subnet": "192.168.198.0/24",
+    "routes": [{ "dst": "0.0.0.0/0" }],
+    "dataDir": "/containerd/run/ipam"
+  }
+}
diff --git a/core/internal/containerd/runsc.toml b/core/internal/containerd/runsc.toml
new file mode 100644
index 0000000..52d846f
--- /dev/null
+++ b/core/internal/containerd/runsc.toml
@@ -0,0 +1,5 @@
+root = "/containerd/run/runsc"
+[runsc_config]
+debug = "false"
+# Setting intentionally left here in case anybody needs it since it is hard to find
+#debug-log = "/containerd/run/runsc-logs/"
\ No newline at end of file