CRI-O is a host-level Kubernetes runtime and should not be run as a nested Docker service for production clusters.