TT Lab
Blog

한국어 English 日本語 中文

Get started
Blog

Blog

Which to Choose Among k3s, RKE2, and k0s: Resource Numbers, Scenario-based Tables, and Decision Flow

Status: Draft (2026-10-13), based on official documentation and release information + partial measurements. Sizes are based on GitHub release file information (retrieved 2026-10-13), requirements are from official documentation (accessed 2026-10-13), and preparation times are measured on TT Lab practice VMs. There are no measurements of the memory usage of all three distributions under the same conditions (unmeasured). The decision flow represents the author's judgment based on the above facts. Writing rules: Measured data is the default, unmeasurable items are marked as "Unmeasured", and items not found in documentation are marked as "Unverified".

Table of Contents

1. Resources: What Was Measured and What Was Not

While we often hear that "k3s is lightweight," we must distinguish which numbers are being referred to. Binary size, the amount of images to transfer, minimum memory required by documentation, and actual memory consumption are all different numbers.

Download Size (GitHub Release File Information, amd64)

k3s v1.37.1+k3s1 RKE2 v1.37.1+rke2r1 k0s v1.36.4+k0s.1
Binary 77.8 MiB 137.1 MiB (41.1 MiB as tar.gz) 251.1 MiB
Contents in Binary Everything (including containerd) Supervisor process only, rest as images Everything (including etcd)
Air-gap Image Bundle 185.4 MiB (zst) Core 558.8 MiB + canal 227.7 MiB (zst), total bundle 787.1 MiB 402.4 MiB

These values were read directly from the GitHub API release file information (sizes) without downloading the files (2026-10-13). Comparing binaries alone, k3s is the smallest and k0s is the largest. However, because the RKE2 binary only acts as a supervisor and pulls the rest as images, looking at the amount to transfer for air-gapping, RKE2 is actually the heaviest.

Documentation descriptions vary. docs.k3s.io and the README state that the k3s binary is under 100MB, while the k3s.io homepage says under 70MB. The actual v1.37.1 file is 77.8 MiB (81.5MB), which matches the former description. RKE2 and k0s had no size figures in their documentation (Unverified).

There are also sizes observed directly on TT Lab practice VMs. The k0s binary was 251MB (measured, 2026-08, same size as release info above), and the extracted installation output from the RKE2 v1.36.4 installation script was 128M (measured). k3s size was not separately recorded during practices (Unmeasured).

Minimum Specs Required by Documentation (Official Docs, Unmeasured)

k3s RKE2 k0s
Server (Controller) 2 cores · 2GB 2 cores · 4GB (Recommended 4 cores · 8GB) 1 vCPU · 1GB
Agent (Worker) 1 core · 512MB Not specified separately from server 1 vCPU · 0.5GB
Both on a single node — — 1 vCPU · 1GB
Disk SSD recommended, no figures provided SSD recommended, no figures provided Controller approx. 0.5GB, worker approx. 1.3GB, both approx. 1.7GB used

These values completely omit resources consumed by workloads. The reason k0s appears the smallest is partly because its controller lacks kubelet and a runtime. A fair comparison requires comparing equivalent roles.

Only k3s has provided official measurements. According to the resource profiling in the k3s documentation (v1.26.5, all package components + Prometheus · Grafana + sample app, 95th percentile in steady state), a server in a cluster with an agent attached on an x86 4-core server used 1,428M (SQLite) · 1,450M (etcd), and the agent used 275M. Because monitoring tools were included, this should not be read solely as "k3s memory." RKE2 provides node sizing guidelines (a 2-core · 4GB server supports up to 225 agents, as of v1.27.4) but no idle usage figures, and k0s also lacks measurement values.

Actual Measurement: Preparation Time

k3s k0s RKE2
From VM creation until node is Ready 82s (Traefik disabled) Approx. 150s No record (Unmeasured)
Install script → Node Ready Install 8s · Ready 11s (v1.35.8) No record No record

These are VM practice preparation times in TT Lab. Since the top row includes VM boot time and internet download time, it reflects the perceived time "until opening a practice session" rather than the speed of the distribution itself. Because k0s uses an etcd --enable-worker configuration, its conditions are not identical to k3s running on SQLite.

How to Measure All Three Distributions Under Identical Conditions

There are as yet no measurements comparing memory and disk under identical conditions. To measure them properly, we need to set up the three distributions with default settings on three VMs of identical size, measure the memory and disk usage of the service cgroups a few times in an idle state, and use the median values. Since this requires freshly downloading binaries and images (equal to the sizes in the table above), we plan to replace this with actual measurements in the next edition.

2. By Scenario

Scenario What to Check First Reason
Edge · IoT · ARM boards, single node k3s Smallest binary, agent minimum 512MB, starts with SQLite without etcd
Dev PC, disposable CI clusters k3s Ingress, LB, and storage are all present right after installation for immediate use
Regulated industries (public sector · finance), audit compliance RKE2 profile: cis, FIPS 140-2 builds, SELinux policies
Starts with etcd from the beginning, similar shape to kubeadm RKE2 Static pods allow kubeadm experience to transfer directly
Operate with a single binary, handpick configurations k0s Defaults are empty and controller is separated from workloads
Multiple hosts managed via a single config file k0s k0sctl installs and joins via SSH, autopilot handles upgrades
Managing multiple clusters from a single Rancher screen k3s or RKE2 Rancher provisions and manages both
Studying for CKA, learning standard ways kubeadm Static pods and etcd backups tested in the exam apply as-is

The last row is not among the three in this article, but is included because it is a frequently asked question. Since k3s uses SQLite as its default storage and runs the control plane as a single process, exam questions regarding "etcd backup" and "fixing static pods" do not apply directly.

3. Decision Flow

위에서부터 묻고, 처음 「예」가 나온 곳에서 멈춘다 새 클러스터를 세운다 ① 규정 준수를 증명해야 하나? FIPS 140 암호 모듈, CIS 벤치마크, 정부·금융 감사 예 RKE2 보안 강화가 한 줄 아니오 ② 노드가 작거나, 빨리 떠야 하나? 엣지·IoT·단일 노드, 개발 PC, CI 의 일회용 클러스터 예 k3s 기본이 다 들어 있다 아니오 ③ 구성을 직접 고르고 싶나? 컨트롤 플레인을 워커와 떼어 두고, CNI·인그레스는 내가 정한다 예 k0s 기본이 비어 있다 아니오 ④ Rancher 로 여러 클러스터를 관리? 한 화면에서 만들고 올리고 지운다 예 k3s · RKE2 무게에 따라 둘 중 하나 아니오 셋 다 맞는다 — 팀이 익숙한 쪽, 또는 시험(CKA)·표준 그대로 배우기가 목적이면 kubeadm 관리 부담을 줄이고 싶으면 관리형(EKS·GKE·AKS) 순서는 「바꾸기 어려운 조건」부터다. 규정은 협상이 안 되고, 하드웨어는 사야 바뀐다.
Figure: Decision Flow for Choosing k3s, RKE2, and k0s

The order of questions matters. Start with conditions that are difficult to change. Compliance cannot be negotiated, and hardware must be newly purchased to be changed. On the other hand, wanting to "handpick configurations" is a preference, and you can largely accommodate it in k3s as well by using --disable to disable default components and install what you want.

This flow is the author's synthesis. If your team is already familiar with a particular distribution, that experience may outweigh the differences above.

4. Migration Bottlenecks

For example, if you use k3s for development and RKE2 for production, the same manifests must travel back and forth between the two distributions. Four things frequently cause friction here. Items 1 and 4 were experienced firsthand during practices, while items 2 and 3 stem from differences found in the default settings table (Part 1, Section 5).

  1. CIDR blocks. k3s and RKE2 use 10.42/10.43, while k0s uses 10.244/10.96. Check first if they overlap with overlay environments or internal corporate networks (Part 1, Section 6).
  2. Ingress classes. k3s uses Traefik, RKE2 uses Traefik or ingress-nginx depending on the build version, and k0s has none. Because annotations differ per controller, designing manifests to accept Gateway API or class names as values reduces migration costs.
  3. Storage classes. k3s's local-path does not exist in RKE2 or k0s. Hardcoding names in manifests will leave PVCs stuck in Pending.
  4. Pod security. Privileged pods that run under k3s and k0s defaults are rejected under the CIS profile in RKE2. However, since already running pods continue to run, this is only revealed during the next deployment (Part 2, Section 3).

5. In TT Lab

TT Lab's practice service itself runs on Kubernetes (v1.34 series) built with kubeadm. Furthermore, k3s, k0s, and RKE2 are built directly inside the course's VM practices. All "actual measurements" in this series came from those practice VMs.

If you want to try the same thing hands-on, check out TT Lab's "Kubernetes Distributions — Building from Scratch" course (search for "Distributions" in the site's course list). The modules intersecting with this article are as follows.

Titi's Note. Light isn't always k3s, and secure isn't always RKE2. Asking "What is the hardest thing to change later?" yields answers much faster. And when looking at numbers, always verify whether they are binary sizes, minimum specs, or genuinely measured memory.

References

All materials were accessed and retrieved on 2026-10-13.

Sign in to like

Comments

No comments yet.

Sign in to leave a comment