rkt tries to stay out of the way for everything that isn't "download, validate, and execute a container". For example, it doesn't know about networks but will hook out to CNI to setup a network namespace. It isn't an init system and will instead rely on a system init system to monitor it. It doesn't do any clustering but can be used by things like Kubernetes.