crio.conf(5)(Kubernetes)

📦

version 1.37.2 · 13 versions

💅 crio.conf(5) — Kubernetes daemon page, bestie edition 💅

okay so real quick — the manual name is crio.conf(5) and it lives in the Kubernetes daemon section, authored by Aleksa Sarai, OCTOBER 2016. This is part 1 of the glow-up, more is coming, don't you dare close the tab 🫶

✨ NAME ✨

crio.conf — the config file of the CRI-O OCI Kubernetes Container Runtime daemon. iconic behavior, honestly 💅

🎀 DESCRIPTION 🎀

So the CRI-O config file is where every single config option and command-line flag for the crio(8) OCI Kubernetes Container Runtime daemon (./crio.8.md) gets to live — but in TOML format, because TOML is way easier to hand-edit and to version-control. slay.

CRI-O lowkey supports partial configuration reload during runtime, and you trigger it by yeeting a SIGHUP at the running process. Right now the options in crio.conf that can do this are explicitly marked with the text 'This option supports live configuration reload'. look for that string, that's the tell 👀

The containers-registries.conf(5) file can be reloaded too — same trick, send SIGHUP to the crio process and it picks it up.

The default crio.conf lives at /etc/crio/crio.conf. that's the one, that's home 🏠

🌈 FORMAT 🌈

The encoding of the config file is TOML. yes, that TOML.

Every option and subtable listed on this page is nested under a global "crio" table. There are no bare options — like, zero, do not try it, don't embarrass me 🙈

You can simplify what TOML looks like to:

[table]
option = value

[table.subtable1]
option = value

[table.subtable2]
option = value

so clean, so structured, we love a consistent queen ✨

👑 CRIO TABLE 👑

CRI-O reads its storage defaults from the containers-storage.conf(5) file, which is located at /etc/containers/storage.conf. So if you wanna change the system's defaults, go modify that storage config. But if you only wanna modify storage just for CRI-O, you can set the storage configuration options right here instead. bestie's got options 💖

root="/var/lib/containers/storage" — path to the "root directory". CRI-O stores all of its data in there, container images included. everything. all of it. 🗂️
runroot="/run/containers/storage" — path to the "run directory". CRI-O stores all of its state in this directory.
storage_driver="overlay" — the storage driver used to manage the storage of images and containers. Please refer to containers-storage.conf(5) to see all the available storage drivers — there's a whole menu, go look 🍓
storage_option=[] — a list to pass options to the storage driver. Again, refer to containers-storage.conf(5) to see all the available storage options.
log_dir="/var/log/crio/pods" — the default log directory where all logs go unless directly specified by the kubelet. Heads up though: the log directory you specify must be an absolute directory. no shortcuts, no silliness 💀
version_file="/run/crio/version" — location for CRI-O to lay down the temporary version file. It's used to check whether crio wipe should wipe containers, which should always happen on a node reboot.
version_file_persist="" — location for CRI-O to lay down the persistent version file. It's used to check whether crio wipe should wipe images, which should only happen when CRI-O has been upgraded. different file, different job, iykyk.
imagestore="" — store newly pulled images in the specified path, rather than the path provided by --root.
internal_wipe=true — ⚠️ this option is currently DEPRECATED, and will be removed in the future. It controls whether CRI-O should wipe containers after a reboot and images after an upgrade when the server starts. If you set it to false, you must run crio wipe yourself to wipe the containers and images in those situations. no cap, don't @ me.
internal_repair=true — InternalRepair is whether CRI-O should check if the container and image storage was corrupted after a sudden restart. And if it was? CRI-O also attempts to repair the storage. she fixes things 💅
clean_shutdown_file="/var/lib/crio/clean.shutdown" — location for CRI-O to lay down the clean shutdown file. It's used to check whether crio had time to sync before shutting down. If it's not found, crio wipe will clear the storage directory. 😭

🦋 CRIO.API TABLE 🦋

The crio.api table contains settings for the kubelet/gRPC interface. this is where the talking happens.

listen="/run/crio/crio.sock" — path to the AF_LOCAL socket on which CRI-O will listen. 📡
stream_address="127.0.0.1" — IP address on which the stream server will listen.
stream_port="0" — the port on which the stream server will listen. If the port is set to "0", then CRI-O will allocate a random free port number. surprise port! 🎁
stream_enable_tls=false — enable encrypted TLS transport of the stream server.
stream_idle_timeout="" — length of time until open streams terminate due to lack of activity. the vibe check timeout basically ⏳
stream_tls_cert="" — path to the x509 certificate file used to serve the encrypted stream. This file can change, and CRI-O will automatically pick up the changes within 5 minutes.
stream_tls_key="" — path to the key file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.
stream_tls_ca="" — path to the x509 CA(s) file used to verify and authenticate client communication with the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.
tls_min_version="VersionTLS12" — minimum TLS version for streaming and metrics servers. The valid values are "VersionTLS12" and "VersionTLS13". Default is "VersionTLS12". 🔐
tls_cipher_suites=[] — list of cipher suites for TLS 1.2. If it's omitted, the default Go cipher suites will be used. This has no effect on TLS 1.3, because Go manages cipher suites automatically. sorry bestie, that's just how Go is.
grpc_max_send_msg_size=16777216 — maximum gRPC send message size in bytes. If it's not set or it's <=0, then CRI-O will default to 16 _ 1024 _ 1024. big messages, bigger energy 🔥
grpc_max_recv_msg_size=16777216 — maximum gRPC receive message size. If it's not set or it's <= 0, then CRI-O will default to 16 _ 1024 _ 1024.

🧚 CRIO.RUNTIME TABLE 🧚

The crio.runtime table contains settings pertaining to the OCI runtime that gets used, plus options for how to set up and manage that OCI runtime. this is the main character table honestly 👑

default_runtime="crun" — the name of the OCI runtime to be used as the default. This option supports live configuration reload. ✨
default_ulimits=[] — a list of ulimits to be set in containers by default, specified as "=:" — for example: "nofile=1024:2048". If nothing is set here, settings will be inherited from the CRI-O daemon. 🍓
no_pivot=false — if true, the runtime will not use pivot_root, but instead use MS_MOVE. okay slay, different move.
decryption_keys_path="/etc/crio/keys/" — path where the keys required for image decryption are located. 🗝️
additional_artifact_stores=[] — a list of additional read-only OCI artifact store paths. CRI-O expects an "artifacts/" subdirectory within each configured path. All entries must be absolute paths. Artifacts in these stores take priority over the main store. And because these stores are read-only, CRI-O cannot remove artifacts from them — so if a tag is re-pointed on the registry, the stale local copy in a read-only store will continue to be used. You have to remove the artifact from the read-only store directly on the filesystem to pick up the new version. 😬 yeah. manual labor.
conmon="" — path to the conmon binary, used for monitoring the OCI runtime. Will be searched for using $PATH if empty. ⚠️ This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorPath.
conmon_cgroup="" — cgroup setting for conmon. ⚠️ This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorCgroup.
conmon_env=[] — environment variable list for the conmon process, used for passing necessary environment variables to conmon or the runtime. ⚠️ This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorEnv.
default_env=[] — additional environment variables to set for all the containers. These are overridden if set in the container image spec or in the container runtime configuration. sorry, the container always wins 💅
min_injected_gomaxprocs=0 — enables GOMAXPROCS injection for burstable and best-effort pod containers. This value acts as a minimum floor. For burstable pods with a CPU request, GOMAXPROCS is auto-calculated from the request; the calculated value is only used if it exceeds this floor. For best-effort pods (no CPU request), this value is used directly. Guaranteed and workload-partitioned pods are skipped. Set it to 0 to disable (that's the default). 🧮
selinux=false — if true, SELinux will be used for pod separation on the host. ⚠️ This option is deprecated, and will be interpreted from whether SELinux is enabled on the host in the future.
seccomp_profile="" — path to the seccomp.json profile which is used as the default seccomp profile for the runtime. If it's not specified, then the internal default seccomp profile will be used.
privileged_seccomp_profile="" — enable a seccomp profile for privileged containers from the local path. yes, privileged ones can have one too, look at her go 🙈
apparmor_profile="" — used to change the name of the default AppArmor profile of CRI-O. The default profile name is "crio-default". 🛡️
blockio_config_file="" — path to the blockio class configuration file for configuring the cgroup blockio controller.
blockio_reload=false — if true, the runtime reloads blockio_config_file and rescans block devices in the system before applying blockio parameters. thorough queen 🔍
cdi_spec_dirs=[] — directories to scan for Container Device Interface Specifications to enable CDI device injection. For more details about CDI and the syntax of CDI Spec files, please refer to https://github.com/container-orchestrated-devices/container-device-interface.

Directories later in the list have precedence over earlier ones. The default directory list is:

cdi_spec_dirs = [
     "/etc/cdi",
     "/run/cdi",
]

irqbalance_config_file="/etc/sysconfig/irqbalance" — used to change the irqbalance service config file which is used by CRI-O. For CentOS/SUSE, this file is located at /etc/sysconfig/irqbalance. For Ubuntu, this file is located at /etc/default/irqbalance. pick your distro, bestie 🐧
irqbalance_config_restore_file="/etc/sysconfig/orig_irq_banned_cpus" — used to set the irqbalance banned cpu mask to restore at CRI-O startup. If it's set to 'disable', no restoration attempt will be done.
rdt_config_file="" — path to the RDT configuration file for configuring the resctrl pseudo-filesystem.
cgroup_manager="systemd" — cgroup management implementation used for the runtime.
default_capabilities=[] — list of default capabilities for containers. If it's empty or commented out, only the capabilities defined in the container json file by the user/kube will be added.

The default list is:

default_capabilities = [
     "CHOWN",
     "DAC_OVERRIDE",
     "FSETID",
     "FOWNER",
     "SETGID",
     "SETUID",
     "SETPCAP",
     "NET_BIND_SERVICE",
     "KILL",
]

add_inheritable_capabilities=false — add capabilities to the inheritable set, as well as the default group of permitted, bounding and effective. If capabilities are expected to work for non-root users, this option should be set. yes, this one, set it. 🫶
default_sysctls=[] — list of default sysctls. If it's empty or commented out, only the sysctls defined in the container json file by the user/kube will be added.

One example would be allowing ping inside of containers. On systems that support /proc/sys/net/ipv4/ping_group_range, the default list could be:

default_sysctls = [
     "net.ipv4.ping_group_range = 0   2147483647",
]

and that's where part 1 wraps, but we're not done — more tables are loading, stay tuned 💖

allowed_devices=[] — the list of devices on the host that a user is actually allowed to specify using the "devices.crio.io" annotation 💅 like, these are the devices that get the VIP pass, no sneaking extras in.
additional_devices=[] — extra devices, bestie! Format is "::"-ish, for example: "--additional-devices=/dev/sdc:/dev/xvdc:rwm". If it's empty or commented out, then only the devices defined in the container json file by the user/kube get added. That's it. No secret bonus devices 🎀
hooks_dir=["path", ...] — every *.json file in the path configures a hook for CRI-O containers ✨. For the full tea on the JSON file syntax and what hook injection even means, go read oci-hooks(5). CRI-O currently supports both the 1.0.0 and 0.1.0 hook schemas, although heads up — the 0.1.0 schema is deprecated 💀.

Paths listed later in the array have higher precedence (oci-hooks(5) goes into directory precedence if you're curious).

For the annotation conditions, CRI-O uses the Kubernetes annotations, which are a subset of the annotations passed to the OCI runtime. For example, io.kubernetes.cri-o.Volumes is part of the OCI runtime configuration annotations, but it is not part of the Kubernetes annotations being matched for hooks 👀.

For the bind-mount conditions, only mounts explicitly requested by Kubernetes configuration are considered. Bind mounts that CRI-O inserts by default (e.g. /dev/shm) are not considered. So don't come for CRI-O about those, she put them there herself 🫶

default_mounts=[] — list of default mounts for each container. Deprecated: this option will be removed in future versions in favor of default_mounts_file 🥲 (she's retiring, respect her).
default_mounts_file="" — path to the file specifying the default mounts for each container. The format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads its default mounts from the following two files:
1. /etc/containers/mounts.conf (i.e., default_mounts_file): this is the override file, where users can either add in their own default mounts, or override the default mounts shipped with the package.
2. /usr/share/containers/mounts.conf: this is the default file read for mounts. If you want CRI-O to read from a different, specific mounts file, you can change the default_mounts_file. Note — if this is done, CRI-O will only add mounts it finds in this file 👑
pids_limit=-1 — maximum number of processes allowed in a container. This option is deprecated. The Kubelet flag --pod-pids-limit should be used instead. Move over, she's leaving 🌸
log_filter="" — filter the log messages by the provided regular expression. This option supports live configuration reload ✨. For example 'request:.*' filters all gRPC requests. iykyk.
log_level="info" — changes the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, debug, and trace. This option supports live configuration reload 💅
log_size_max=-1 — maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it's positive, it must be >= 8192 to match/exceed conmon's read buffer. The file is truncated and re-opened so the limit is never exceeded. This option is deprecated. The Kubelet flag --container-log-max-size should be used instead 🙈
log_to_journald=false — whether container output should be logged to journald in addition to the kubernetes log file. Double logging, main character energy 💖
container_exits_dir="/run/crio/exits" — path to the directory in which container exit files are written to by conmon.
container_attach_socket_dir="/run/crio" — path to the directory for container attach sockets.
bind_mount_prefix="" — a prefix to use for the source of the bind mounts. This one's lowkey so useful when running CRI-O in a container and the / directory on the host is mounted as /host in the container 🦋. Then if CRI-O runs with the --bind-mount-prefix=/host option, CRI-O would add the /host directory to any bind mounts it hands over to CRI. If Kubernetes asked to have /var/lib/foobar bind mounted into the container, then CRI-O would bind mount /host/var/lib/foobar. Since CRI-O itself is running in a container with / or the host mounted on /host, the container would end up with /var/lib/foobar from the host mounted in the container rather than /var/lib/foobar from the CRI-O container 🧚 periodt.
read_only=false — if set to true, all containers will run in read-only mode. Literally all of them. No writing. None. 🔒
uid_mappings="" — the UID mappings for the user namespace of each container. A range is specified in the form containerUID:HostUID:Size. Multiple ranges must be separated by comma. This option is deprecated, and will be replaced with native Kubernetes user namespace support in the future 🥲
minimum_mappable_uid=-1 — the lowest host UID which can be specified in mappings supplied, either as part of a uid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0. This option is deprecated, and will be replaced with Kubernetes user namespace support (KEP-127) in the future 🎀
gid_mappings="" — the GID mappings for the user namespace of each container. A range is specified in the form containerGID:HostGID:Size. Multiple ranges must be separated by comma. This option is deprecated, and will be replaced with Kubernetes user namespace support (KEP-127) in the future 💀
minimum_mappable_gid=-1 — the lowest host GID which can be specified in mappings supplied, either as part of a gid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0. This option is deprecated, and will be replaced with Kubernetes user namespace support (KEP-127) in the future 🙈
ctr_stop_timeout=30 — the minimal amount of time in seconds to wait before issuing a timeout regarding the proper termination of the container. Give her a sec to say goodbye 😭
drop_infra_ctr=true — determines whether we drop the infra container when a pod does not have a private PID namespace, and does not use a kernel separating runtime (like kata). Requires manage_ns_lifecycle to be true ⚠️
infra_ctr_cpuset="" — determines the CPU set to run infra containers. If not specified, CRI-O will use all online CPUs to run infra containers. You can specify CPUs in the Linux CPU list format. To get better isolation for guaranteed pods, set this parameter to be equal to kubelet reserved-cpus ✨
shared_cpuset="" — determines the CPU set which is allowed to be shared between guaranteed containers, regardless of, and in addition to, the exclusiveness of their CPUs. This field is optional and would not be used if not specified. You can specify CPUs in the Linux CPU list format 🦋
namespaces_dir="/run" — the directory where the state of the managed namespaces gets tracked. Only used when manage_ns_lifecycle is true 👑
pinns_path="" — the path to find the pinns binary, which is needed to manage namespace lifecycle.
absent_mount_sources_to_reject=[] — a list of paths that, when absent from the host, will cause a container creation to fail (as opposed to the current behavior of creating a directory). Like, no cap, she will simply refuse 🫶
device_ownership_from_security_context=false — changes the default behavior of setting container devices uid/gid from CRI's SecurityContext (RunAsUser/RunAsGroup) instead of taking host's uid/gid.
enable_criu_support=true — enable CRIU integration, requires that the criu binary is available in $PATH. (default: true) This option is deprecated, use the container_level_enabled option in the crio.checkpoint_restore table instead. When set to false it is translated to container_level_enabled = "none" 🌈
enable_pod_events=false — enable CRI-O to generate the container pod-level events in order to optimize the performance of the Pod Lifecycle Event Generator (PLEG) module in Kubelet.
hostnetwork_disable_selinux=true — determines whether SELinux should be disabled within a pod when it's running in the host network namespace 💅
disable_hostport_mapping=false — enable/disable the container hostport mapping in CRI-O. Default value is set to 'false'.
timezone="" — to set the timezone for a container in CRI-O. If an empty string is provided, CRI-O retains its default behavior. Use 'Local' to match the timezone of the host machine 🌍

🦋 CRIO.RUNTIME.RUNTIMES TABLE 🦋

The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. The runtime to use is picked based on the runtime handler provided by the CRI. If no runtime handler is provided, the runtime will be picked based on the level of trust of the workload. This option supports live configuration reload. This option supports live configuration reload 😭 (yes she said it twice, she's just like that, and yes both are in here because we keep every detail 💖).

runtime_path="" — path to the OCI compatible runtime used for this runtime handler.
runtime_root="" — root directory used to store runtime data.
runtime_type="oci" — type of the runtime used for this runtime handler. Valid values are:
- "oci" (default): standard OCI runtime (e.g. runc, crun). The runtime_path should point to the OCI runtime binary 🏃‍♀️
- "vm": VM-isolation shim using the containerd shimv2/ttrpc protocol. The runtime_path must be a containerd-shim-* binary. This runtime type is exercised in CI with Kata Containers https://github.com/kata-containers/kata-containers (containerd-shim-kata-v2). Other shimv2 shims implement the same protocol and may work — for example gVisor https://github.com/google/gvisor's containerd-shim-runsc-v1 — but are not currently covered by CI 👀
- "pod": pod-level runtime using conmon-rs https://github.com/containers/conmon-rs instead of conmon. conmon-rs operates at pod granularity ✨
inherit_default_runtime=false — override the runtime path, runtime config path, runtime root and runtime type from the default runtime on load.
runtime_config_path="" — path to the runtime configuration file, should only be used with VM runtime types 🎀
privileged_without_host_devices=false — whether this runtime handler prevents host devices from being passed to privileged containers.
allowed_annotations=[] — this field is currently DEPRECATED. If you'd like to use allowed_annotations, please use a workload. A list of experimental annotations this runtime handler is allowed to process. The currently recognized values are:
- "userns-mode.crio.io" for configuring a user namespace for the pod.
- "devices.crio.io" for configuring devices for the pod.
- "shm-size.crio.io" for configuring the size of /dev/shm.
- "unified-cgroup.crio.io/$CTR_NAME" for configuring the cgroup v2 unified block for a container.
- "io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.
- "seccomp-profile.crio.io" for setting the seccomp profile for:
  - a specific container by using: "seccomp-profile.crio.io/"
  - a whole pod by using: "seccomp-profile.crio.io/POD"

Note that the annotation works on containers as well as on images. For images, the plain annotation seccomp-profile.crio.io can be used without the required /POD suffix or a container name 💅

container_min_memory="" — the minimum memory that must be set for a container. This value can be used to override the currently set global value for a specific runtime. If not set, a global default value of "12 MiB" will be used 🌸
platform_runtime_paths={} — a mapping of platforms → the matching runtime executable paths for the runtime handler. 💅
no_sync_log=false — set it to true and the runtime will not sync the log file on rotate or container exit. Only valid for the 'oci' runtime type. ⚠️ flip this to true and you can literally cause data loss, like when a machine crash happens. So… don't be casual about it.
default_annotations={} — a mapping of keys → values of annotations set on containers run by this runtime handler, unless the pod spec overrides them.
stream_websockets=false — enables the WebSocket protocol for container exec, attach and port forward. conmon-rs (runtime_type = "pod") supports this configuration for exec and attach. Forwarding ports will be supported in future releases. 👀
seccomp_profile="" — path to the seccomp.json profile used as the default seccomp profile for the runtime. If not specified, then the crio.runtime seccomp profile gets used. If that one also isn't specified, then the internal default seccomp profile is used. 🎀
container_create_timeout=240 — the timeout for container creation operations, in seconds. If not set, defaults to 240 seconds. If you set it to a value less than 30 seconds, it gets automatically adjusted to 30 seconds (the minimum allowed value). This lets different runtime handlers have different container creation timeouts, which is lowkey perfect for VM-based runtimes that may need longer timeouts than OCI runtimes. conmon-rs (runtime_type = "pod") doesn't support the configurable container creation timeout.

Note, bestie, read this one: the effective timeout is the minimum of this value and kubelet's --runtime-request-timeout (default: 2 minutes). So if you set container_create_timeout = 600 (10 minutes) but kubelet has the default 2-minute timeout, the operation will be canceled after 2 minutes. 😭 Configure both values consistently for VM-based runtimes. For more information about kubelet's runtime request timeout, see the Kubelet documentation (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/).

✨ CRIO.RUNTIME.WORKLOADS TABLE ✨

The "crio.runtime.workloads" table defines a list of workloads — a way to customize the behavior of a pod and container. A workload is chosen for a pod based on whether the workload's activation_annotation is an annotation on the pod. 🦋

activation_annotation="" — activation_annotation is the pod annotation that activates these workload settings.
annotation_prefix="" — annotation_prefix is the way a pod can override a specific resource for a container. The full annotation must be of the form $annotation_prefix.$resource/$ctrname = $value. 💜
allowed_annotations=[] — allowed_annotations is a slice of experimental annotations that this workload is allowed to process. The currently recognized values are:
- "userns-mode.crio.io" for configuring a user namespace for the pod.
- "cgroup2-mount-hierarchy-rw.crio.io" for mounting cgroups writably when set to "true".
- "devices.crio.io" for configuring devices for the pod.
- "shm-size.crio.io" for configuring the size of /dev/shm.
- "unified-cgroup.crio.io/$CTR_NAME" for configuring the cgroup v2 unified block for a container.
- "io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.
- "seccomp-notifier-action.crio.io" for enabling the seccomp notifier feature.
- "umask.crio.io" for setting the umask for container init process.
- "io.kubernetes.cri.rdt-class" for setting the RDT class of a container
- "seccomp-profile.crio.io" for setting the seccomp profile for:
  - a specific container by using: "seccomp-profile.crio.io/"
  - a whole pod by using: "seccomp-profile.crio.io/POD"

Note that the annotation works on containers as well as on images. 🎀

"disable-fips.crio.io" for disabling FIPS mode for a pod within a FIPS-enabled Kubernetes cluster.

🌸 Using the seccomp notifier feature 🌸

This feature can help you debug seccomp related issues, for example if blocked syscalls (permission denied errors) have a negative impact on the workload. 🔥

To be able to use this feature, configure a runtime which has the annotation "seccomp-notifier-action.crio.io" in the allowed_annotations array.

It also requires at least runc 1.1.0 or crun 0.19 which support the notifier feature.

If everything is setup, CRI-O will modify chosen seccomp profiles for containers if the annotation "seccomp-notifier-action.crio.io" is set on the Pod sandbox. CRI-O will then get notified if a container is using a blocked syscall and then terminate the workload after a timeout of 5 seconds if the value of "seccomp-notifier-action.crio.io=stop".

This also means that multiple syscalls can be captured during that period, while the timeout will get reset once a new syscall has been discovered. 💫

This also means that the Pods "restartPolicy" has to be set to "Never", otherwise the kubelet will restart the container immediately.

Please be aware that CRI-O is not able to get notified if a syscall gets blocked based on the seccomp defaultAction, which is a general runtime limitation. 💀

🧚 CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE 🧚

The resources table is a structure for overriding certain resources for pods using this workload. This structure provides a default value, and can be overridden by using the AnnotationPrefix. ⭐

cpushares="" — specifies the number of CPU shares this pod has access to.
cpuset="" — specifies the cpuset this pod has access to.

👑 CRIO.CHECKPOINT_RESTORE TABLE 👑

The crio.checkpoint_restore table contains settings pertaining to the checkpoint and restore (CRIU) support for containers. 🫶

container_level_enabled="checkpoint_only" — configures the level of container checkpoint and restore (CRIU) support. It accepts one of the following values:
- "none": checkpoint and restore support is disabled.
- "checkpoint_only": only checkpointing containers is enabled.
- "checkpoint_restore": both checkpointing and restoring containers is enabled.

🌈 CRIO.IMAGE TABLE 🌈

The crio.image table contains settings pertaining to the management of OCI images.

CRI-O reads its configured registries defaults from the system wide containers-registries.conf(5) located in /etc/containers/registries.conf. 📁

default_transport="docker://" — default transport for pulling images from a remote container storage.
global_auth_file="" — the path to a file like /var/lib/kubelet/config.json holding credentials necessary for pulling images from secure registries.
pause_image="registry.k8s.io/pause:3.10.2" — the on-registry image used to instantiate infra containers. The value should start with a registry host name. This option supports live configuration reload. ✨
pause_image_auth_file="" — the path to a file like /var/lib/kubelet/config.json holding credentials specific to pulling the pause_image from above. This option supports live configuration reload.
pause_command="/pause" — the command to run to have a container stay in the paused state. This option supports live configuration reload.
pinned_images=[] — a list of images and OCI artifacts to be excluded from the kubelet's garbage collection. It allows specifying image names using either exact, glob, or keyword patterns. Exact matches must match the entire name, glob matches can have a wildcard * at the end, and keyword matches can have wildcards on both ends. By default, this list includes the pause image if configured by the user, which is used as a placeholder in Kubernetes pods. 🎀
signature_policy="" — path to the file which decides what sort of policy we use when deciding whether or not to trust an image that we've pulled. It is not recommended that this option be used, as the default behavior of using the system-wide default policy (i.e., /etc/containers/policy.json) is most often preferred. Please refer to containers-policy.json(5) for more details. 🙈
signature_policy_dir="/etc/crio/policies" — root path for pod namespace-separated signature policies. The final policy to be used on image pull will be /<NAMESPACE>.json. If no pod namespace is being provided on image pull (via the sandbox config), or the concatenated path is non existent, then the signature_policy or system wide policy will be used as fallback. Must be an absolute path.
image_volumes="mkdir" — controls how image volumes are handled. The valid values are mkdir, bind and ignore; the latter will ignore volumes entirely.
big_files_temporary_dir="" — path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management.
separate_pull_cgroup="" — [EXPERIMENTAL] if its value is set, then images are pulled into the specified cgroup. If its value is set to "pod", then the pod's cgroup is used. It is currently supported only with the systemd cgroup manager.
auto_reload_registries=false — if true, CRI-O will automatically reload the mirror registry when there is an update to the 'registries.conf.d' directory. Default value is set to 'false'.
pull_progress_timeout="0s" — the timeout for an image pull to make progress until the pull operation gets canceled. This value will be also used for calculating the pull progress interval to pull_progress_timeout / 10. Can be set to 0 to disable the timeout as well as the progress output.
oci_artifact_mount_support=true — this option is whether CRI-O enables OCI Artifact mount. If true, CRI-O can mount OCI artifacts as volumes. 💅
short_name_mode="enforcing" — this option describes the short name mode. The valid values are "enforcing" and "disabled", and the default is "enforcing". If "enforcing", an image pull will fail if a short name is used, but the results are ambiguous. If "disabled", the first result will be chosen.

💖 CRIO.NETWORK TABLE 💖

The crio.network table containers settings pertaining to the management of CNI plugins.

cni_default_network="" — the default CNI network name to be selected. If not set or "", then CRI-O will pick-up the first one found in network_dir.
network_dir="/etc/cni/net.d/" — path to the directory where CNI configuration files are located.
plugin_dirs=["/opt/cni/bin/",] — list of paths to directories where CNI plugin binaries are located.
cni_status_grace_period="0s" — enable continuous CNI STATUS monitoring with the given grace period. When set to "0s" (default), monitoring is disabled and plugin health is only determined at startup; runtime failures will not be detected. When set to a positive duration (e.g. "1m"), a background goroutine polls the plugin every 5 seconds and waits for this grace period before marking the node not-ready, tolerating brief CNI disruptions during plugin upgrades (e.g. OVN-K daemonset rollout). 🦋

🎀 CRIO.METRICS TABLE 🎀

Okay bestie, this table is all about the settings for Prometheus-based metrics retrieval. Very “numbers are cute actually” energy.

enable_metrics=false — the global on/off switch for metrics support.
metrics_collectors=[...] — choose which metrics collectors are enabled. Per default, all metrics are enabled. The default lineup is exactly this:

["image_pulls_layer_size", "containers_events_dropped_total", "containers_oom_total", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total", "containers_seccomp_notifier_count_total", "resources_stalled_at_stage", "containers_stopped_monitor_count", "default_runtime"]

metrics_host="127.0.0.1" — the IP address or hostname on which the metrics server will listen.
metrics_port=9090 — the port on which the metrics server will listen.
metrics_socket="" — the socket on which the metrics server will listen.
metrics_cert="" — the certificate for the secure metrics server.
metrics_key="" — the certificate key for the secure metrics server.

🦋 CRIO.TRACING TABLE 🦋

[EXPERIMENTAL] bestie, this one is tagged experimental in the original, so proceed with main-character caution.

This table contains settings for exporting OpenTelemetry trace data.

enable_tracing=false — globally enable or disable OpenTelemetry trace data exporting.
tracing_endpoint="127.0.0.1:4317" — the address on which the gRPC trace collector will listen.
tracing_sampling_rate_per_million="" — number of samples to collect per million OpenTelemetry spans. Set to 1000000 to always sample.

🌸 CRIO.STATS TABLE 🌸

The crio.stats table specifies all the necessary configuration for reporting container and pod stats. Very “tell me everything about your little pods” of it.

stats_collection_period=0 — the number of seconds between collecting pod and container stats. If set to 0, stats are collected on-demand instead.

DEPRECATED: this option will be removed in the future. Please use collection_period instead.

collection_period=0 — the number of seconds between collecting pod/container stats and pod sandbox metrics. If set to 0, the metrics/stats are collected on-demand instead.
included_pod_metrics=[] — a list of pod metrics to include. Specify the names of the metrics to include in this list. If empty, only always-on metrics are included. Available values are "cpu", "hugetlb", "memory", "memoryExtra", "network", "oom", "process", "spec", "disk", "diskIO", "pressure". "memory" covers the metrics with a cAdvisor equivalent, while "memoryExtra" covers the additional anonymous memory and transparent hugepage metrics, so they can be enabled independently. You can also specify "all" to include all available metrics. If you specify "all", it should be the only item in the list.

🧚 CRIO.NRI TABLE 🧚

The crio.nri table contains settings for controlling NRI (Node Resource Interface) support in CRI-O. Look at her, managing nodes and resources.

enable_nri=true — enable CRI-O NRI support.
nri_plugin_dir="/opt/nri/plugins" — directory to scan for pre-installed plugins to automatically start.
nri_plugin_config_dir="/etc/nri/conf.d" — directory to scan for configuration of pre-installed plugins.
nri_listen="/run/nri/nri.sock" — socket to listen on for externally started NRI plugins to connect to.
nri_disable_connections=false — disable connections from externally started NRI plugins.
nri_plugin_registration_timeout="5s" — timeout for a plugin to register itself with NRI.
nri_plugin_request_timeout="2s" — timeout for a plugin to handle an NRI request.

👑 CRIO.NRI.DEFAULT_VALIDATOR TABLE 👑

The crio.nri.default_validator table contains settings for the default built-in NRI validator plugin, which can be used to restrict what types of modifications other NRI plugins can make to containers. She’s the bouncer at the club, honestly.

nri_enable_default_validator=false — enable the default NRI validator plugin.
nri_validator_reject_oci_hook_adjustment=false — reject NRI plugin adjustment of OCI Hooks.
nri_validator_reject_runtime_default_seccomp_adjustment=false — reject NRI plugin adjustment of runtime default seccomp policy.
nri_validator_reject_unconfined_seccomp_adjustment=false — reject NRI plugin adjustment of unconfined seccomp policy.
nri_validator_reject_custom_seccomp_adjustment=false — reject NRI plugin adjustment of custom seccomp policy.
nri_validator_reject_namespace_adjustment=false — reject NRI plugin adjustment of linux namespaces.
nri_validator_required_plugins=[] — list of required NRI plugins that must be present.
nri_validator_tolerate_missing_plugins_annotation="" — name of the annotation used to indicate toleration of missing required NRI plugins.

✨ SEE ALSO ✨

Go read these too, bestie — they’re the supporting cast:

💜 HISTORY 💜

Aug 2018, Update to the latest state by Valentin Rothberg vrothberg@suse.com ⟨mailto:vrothberg@suse.com⟩
Oct 2016, Originally compiled by Aleksa Sarai asarai@suse.de ⟨mailto:asarai@suse.de⟩

And that’s the whole page, bestie 💖 source/version Runtime / Container, manual title crio.conf(5)(Kubernetes), and the date we’re rolling with is OCTOBER 2016. Go forth and configure something iconic 🎀✨

📦 where this page comes from

arch rolling: cri-o 1.37.2-1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-06: a language model's rewrite of the original, under its terms