CONTAINERD-CTR(8)

📦

version 1.7.33 · 4 versions

1.7.33 · opensuse-leap 16.0 (latest)
1.7.33 · opensuse-leap 16.0
1.7.33 · opensuse-leap 16.0
1.7.33 · opensuse-leap 16.0

💅 ctr(8) — the containerd command, but make it a group chat

okay so real talk first, bestie: ctr is an unsupported debug and administrative client for interacting with the containerd daemon. and because it's unsupported, the commands, the options and the operations are not guaranteed to be backward compatible or stable from release to release of the containerd project. like… no cap, no promises, the vibes shift between releases. read the flags, love the flags, don't build your whole personality on them 🫶

🎀 NAME

ctr

✨ SYNOPSIS

ctr

       [--address|-a]=[value]
       [--connect-timeout]=[value]
       [--debug]
       [--namespace|-n]=[value]
       [--timeout]=[value]

Usage:

ctr [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]

🌸 GLOBAL OPTIONS

--address, -a="" — the address for containerd's GRPC server (default: /run/containerd/containerd.sock). this is the little doorway where your client knocks 💅
--connect-timeout="" — timeout for connecting to containerd (default: 0s)
--debug — enable debug output in logs. turn this on when you wanna see everything, main character energy
--namespace, -n="" — namespace to use with commands (default: default). your own little bubble ✨
--timeout="" — total timeout for ctr commands (default: 0s)

👑 COMMANDS

🧩 `plugins`, `plugin`

Provides information about containerd plugins

`list`, `ls`

Lists containerd plugins

--detailed, -d — print detailed information about each plugin
--quiet, -q — print only the plugin ids

⭐ `version`

Print the client and server versions

📦 `containers`, `c`, `container`

Manage containers

`create`

Create container

--allow-new-privs — turn off OCI spec's NoNewPrivileges feature flag
--annotation="" — specify additional OCI annotations (e.g. foo=bar)
--apparmor-default-profile="" — enable AppArmor with the default profile with the specified name, e.g. "cri-containerd.apparmor.d"
--apparmor-profile="" — enable AppArmor with an existing custom profile
--blockio-class="" — name of the blockio class to associate the container with
--blockio-config-file="" — file path to blockio class definitions. By default class definitions are not loaded.
--cap-add="" — add Linux capabilities (set capabilities with 'CAP_' prefix)
--cap-drop="" — drop Linux capabilities (set capabilities with 'CAP_' prefix)
--config, -c="" — path to the runtime-specific spec config file
--cpu-period="" — limit CPU CFS period (default: 0)
--cpu-quota="" — limit CPU CFS quota (default: -1)
--cwd="" — specify the working directory of the process
--device="" — file path to a device to add to the container; or a path to a directory tree of devices to add to the container
--env="" — specify additional container environment variables (e.g. FOO=bar)
--env-file="" — specify additional container environment variables in a file (e.g. FOO=bar, one per line)
--gpus="" — add gpus to the container 🔥
--hostname="" — set the container's host name
--label="" — specify additional labels (e.g. foo=bar)
--memory-limit="" — memory limit (in bytes) for the container (default: 0)
--mount="" — specify additional container mount (e.g. type=bind,src=/tmp,dst=/host,options=rbind:ro)
--net-host — enable host networking for the container
--no-pivot — disable use of pivot-root (linux only)
--pid-file="" — file path to write the task's pid
--privileged — run privileged container. highkey powerful, be careful 🫣
--rdt-class="" — name of the RDT class to associate the container with. Specifies a Class of Service (CLOS) for cache and memory bandwidth management.
--read-only — set the container's filesystem as readonly
--rootfs — use custom rootfs that is not managed by containerd snapshotter
--rootfs-propagation="" — set the propagation of the container rootfs
--runtime="" — runtime name or absolute path to runtime binary (default: io.containerd.runc.v2)
--runtime-config-path="" — optional runtime config path
--sandbox="" — create the container in the given sandbox
--seccomp — enable the default seccomp profile
--seccomp-profile="" — file path to custom seccomp profile. seccomp must be set to true, before using seccomp-profile
--snapshotter="" — snapshotter name. Empty value stands for the default value.
--snapshotter-label="" — labels added to the new snapshot for this container.
--tty, -t — allocate a TTY for the container
--user, -u="" — username or user id, group optional (format: [:])
--with-ns="" — specify existing Linux namespaces to join at container runtime (format ':')

`delete`, `del`, `remove`, `rm`

Delete one or more existing containers

--keep-snapshot — do not clean up snapshot with container

`info`

Get info about a container

--spec — only display the spec

`list`, `ls`

List containers

--quiet, -q — print only the container id

`label`

Set and clear labels for a container

`checkpoint`

Checkpoint a container

--image — include the image in the checkpoint
--rw — include the rw layer in the checkpoint
--task — checkpoint container task

`restore`

Restore a container from checkpoint

--live — restore the runtime and memory data from the checkpoint
--rw — restore the rw layer from the checkpoint

🗄️ `content`

Manage content

`active`

Display active transfers

--root="" — path to content store root (default: /tmp/content)
--timeout, -t="" — total timeout for fetch (default: 0s)

`delete`, `del`, `remove`, `rm`

Permanently delete one or more blobs. periodt, they're gone 💀

`edit`

Edit a blob and return a new digest

--editor="" — select editor (vim, emacs, etc.)
--validate="" — validate the result against a format (json, mediatype, etc.)

`fetch`

Fetch all content for an image into containerd

--all-metadata — pull metadata for all platforms
--all-platforms — pull content from all platforms
--hosts-dir="" — custom hosts configuration directory
--http-dump — dump all HTTP request/responses when interacting with container registry
--http-trace — enable HTTP tracing for registry interactions
--label="" — labels to attach to the image
--metadata-only — pull all metadata including manifests and configs
--plain-http — allow connections using plain HTTP
--platform="" — pull content from a specific platform
--refresh="" — refresh token for authorization server
--skip-verify, -k — skip SSL certificate validation
--tlscacert="" — path to TLS root CA
--tlscert="" — path to TLS client certificate
--tlskey="" — path to TLS client key
--user, -u="" — user[:password] registry user and password

`fetch-object`

Retrieve objects from a remote

--hosts-dir="" — custom hosts configuration directory
--http-dump — dump all HTTP request/responses when interacting with container registry
--http-trace — enable HTTP tracing for registry interactions
--plain-http — allow connections using plain HTTP
--refresh="" — refresh token for authorization server
--skip-verify, -k — skip SSL certificate validation
--tlscacert="" — path to TLS root CA
--tlscert="" — path to TLS client certificate
--tlskey="" — path to TLS client key
--user, -u="" — user[:password] registry user and password

`fetch-blob`

Retrieve blobs from a remote

--hosts-dir="" — custom hosts configuration directory
--http-dump — dump all HTTP request/responses when interacting with container registry
--http-trace — enable HTTP tracing for registry interactions
--plain-http — allow connections using plain HTTP
--refresh="" — refresh token for authorization server
--skip-verify, -k — skip SSL certificate validation
--tlscacert="" — path to TLS root CA
--tlscert="" — path to TLS client certificate
--tlskey="" — path to TLS client key
--user, -u="" — user[:password] registry user and password

`get`

Get the data for an object

`ingest`

Accept content into the store

--expected-digest="" — verify content against expected digest
--expected-size="" — validate against provided size (default: 0)

`list`, `ls`

List all blobs in the store

--quiet, -q — print only the blob digest

`push-object`

Push an object to a remote

--hosts-dir="" — custom hosts configuration directory
--http-dump — dump all HTTP request/responses when interacting with container registry
--http-trace — enable HTTP tracing for registry interactions
--plain-http — allow connections using plain HTTP
--refresh="" — refresh token for authorization server
--skip-verify, -k — skip SSL certificate validation
--tlscacert="" — path to TLS root CA
--tlscert="" — path to TLS client certificate
--tlskey="" — path to TLS client key
--user, -u="" — user[:password] registry user and password

`label`

Add labels to content

`prune`

Prunes content from the content store

`references`

Prunes preference labels from the content store (layers only by default)

--async — allow garbage collection to cleanup asynchronously
--dry — just show updates without applying (enables debug logging)

🎉 `events`, `event`

Display containerd events — the drama feed, honestly 👀

and bestie, we are so not done — there's still more of this page, keep scrolling 🦋

🌈 images, image, i 🌈

Manage images — your whole local image stash, basically. Main character energy for your content store, no cap.

🧐 check

Check existing images to ensure all content is available locally. It's a full vibe check for your image refs.

--quiet, -q — Print only the ready image refs (fully downloaded and unpacked).
--snapshotter="" — Snapshotter name. Empty value stands for the default value.

📦 export

Export images — pack the vibes up and send them out, bestie.

--all-platforms — Exports content from all platforms.
--local — Run export locally rather than through transfer API.
--platform="" — Pull content from a specific platform.
--skip-manifest-json — Do not add Docker compatible manifest.json to archive.
--skip-non-distributable — Do not add non-distributable blobs such as Windows layers to archive.

📥 import

Import images — bring that content in, periodt.

--all-platforms — Imports content for all platforms, false by default.
--base-name="" — Base image name for added images, when provided only images with this name prefix are imported.
--compress-blobs — Compress uncompressed blobs when creating manifest (Docker format only).
--digests — Whether to create digest images (default: false).
--discard-unpacked-layers — Allow the garbage collector to clean layers up from the content store after unpacking, cannot be used with --no-unpack, false by default.
--index-name="" — Image name to keep index as, by default index is discarded.
--local — Run import locally rather than through transfer API.
--no-unpack — Skip unpacking the images, cannot be used with --discard-unpacked-layers, false by default.
--platform="" — Imports content for specific platform.
--skip-digest-for-named — Skip applying --digests option to images named in the importing tar (use it in conjunction with --digests).
--snapshotter="" — Snapshotter name. Empty value stands for the default value.

📋 list, ls

List images known to containerd — the little image directory of your dreams.

--quiet, -q — Print only the image refs.

🧷 mount

Mount an image to a target path — attachment era.

--hosts-dir="" — Custom hosts configuration directory.
--http-dump — Dump all HTTP request/responses when interacting with container registry.
--http-trace — Enable HTTP tracing for registry interactions.
--label="" — Labels to attach to the image.
--plain-http — Allow connections using plain HTTP.
--platform="" — Mount the image for the specified platform (default: linux/arm64/v8).
--refresh="" — Refresh token for authorization server.
--rw — Enable write support on the mount.
--skip-verify, -k — Skip SSL certificate validation.
--snapshotter="" — Snapshotter name. Empty value stands for the default value.
--tlscacert="" — Path to TLS root CA.
--tlscert="" — Path to TLS client certificate.
--tlskey="" — Path to TLS client key.
--user, -u="" — User[:password] Registry user and password.

🪢 unmount

Unmount the image from the target — release the mount, bestie.

--hosts-dir="" — Custom hosts configuration directory.
--http-dump — Dump all HTTP request/responses when interacting with container registry.
--http-trace — Enable HTTP tracing for registry interactions.
--label="" — Labels to attach to the image.
--plain-http — Allow connections using plain HTTP.
--refresh="" — Refresh token for authorization server.
--rm — Remove the snapshot after a successful unmount.
--skip-verify, -k — Skip SSL certificate validation.
--snapshotter="" — Snapshotter name. Empty value stands for the default value.
--tlscacert="" — Path to TLS root CA.
--tlscert="" — Path to TLS client certificate.
--tlskey="" — Path to TLS client key.
--user, -u="" — User[:password] Registry user and password.

🚀 pull

Pull an image from a remote — fetching the goods from the internet, iconic.

--all-metadata — Pull metadata for all platforms.
--all-platforms — Pull content and metadata from all platforms.
--hosts-dir="" — Custom hosts configuration directory.
--http-dump — Dump all HTTP request/responses when interacting with container registry.
--http-trace — Enable HTTP tracing for registry interactions.
--label="" — Labels to attach to the image.
--local — Fetch content from local client rather than using transfer service.
--max-concurrent-downloads="" — Set the max concurrent downloads for each pull (default: 0).
--plain-http — Allow connections using plain HTTP.
--platform="" — Pull content from a specific platform.
--print-chainid — Print the resulting image's chain ID.
--refresh="" — Refresh token for authorization server.
--skip-verify, -k — Skip SSL certificate validation.
--snapshotter="" — Snapshotter name. Empty value stands for the default value.
--tlscacert="" — Path to TLS root CA.
--tlscert="" — Path to TLS client certificate.
--tlskey="" — Path to TLS client key.
--user, -u="" — User[:password] Registry user and password.

🛫 push

Push an image to a remote — send it, slay.

--allow-non-distributable-blobs — Allow pushing blobs that are marked as non-distributable.
--hosts-dir="" — Custom hosts configuration directory.
--http-dump — Dump all HTTP request/responses when interacting with container registry.
--http-trace — Enable HTTP tracing for registry interactions.
--local — Push content from local client rather than using transfer service.
--manifest="" — Digest of manifest.
--manifest-type="" — Media type of manifest digest (default: application/vnd.oci.image.manifest.v1+json).
--max-concurrent-uploaded-layers="" — Set the max concurrent uploaded layers for each push (default: 0).
--plain-http — Allow connections using plain HTTP.
--platform="" — Push content from a specific platform.
--refresh="" — Refresh token for authorization server.
--skip-verify, -k — Skip SSL certificate validation.
--tlscacert="" — Path to TLS root CA.
--tlscert="" — Path to TLS client certificate.
--tlskey="" — Path to TLS client key.
--user, -u="" — User[:password] Registry user and password.

🧹 prune

Remove unused images — cleanup time, but read the option carefully, bestie.

--all — Remove all unused images, not just dangling ones (if all is not specified no images will be pruned).

🗑️ delete, del, remove, rm

Remove one or more images by reference — yeet by ref.

--sync — Synchronously remove image and all associated resources.

🏷️ tag

Tag an image — give it a new little name sticker.

--force — Force target_ref to be created, regardless if it already exists.
--local — Run tag locally rather than through transfer API.

🔖 label

Set and clear labels for an image — annotate the vibe.

--replace-all, -r — Replace all labels.

🔄 convert

Convert an image — glow-up, but for media types and layers.

--all-platforms — Exports content from all platforms.
--oci — Convert Docker media types to OCI media types.
--platform="" — Pull content from a specific platform.
--uncompress — Convert tar.gz layers to uncompressed tar layers.

📊 usage

Display usage of snapshots for a given image ref — see what's taking up space, iykyk.

--snapshotter="" — Snapshotter name. Empty value stands for the default value.

🎫 leases 🎫

Manage leases — the resource-holding little contracts of your containerd era.

📋 list, ls

List all active leases.

--quiet, -q — Print only the blob digest.

✨ create

Create lease.

--expires, -x="" — Expiration of lease (0 value will not expire) (default: 24h0m0s).
--id="" — Set the id for the lease, will be generated by default.

🗑️ delete, del, remove, rm

Delete a lease.

--sync — Synchronously remove leases and all unreferenced resources.

🪐 namespaces, namespace, ns 🪐

Manage namespaces — separate little worlds, fr fr.

✨ create, c

Create a new namespace.

📋 list, ls

List namespaces.

--quiet, -q — Print only the namespace name.

🗑️ remove, rm

Remove one or more namespaces.

--cgroup, -c — Delete the namespace's cgroup.

🔖 label

Set and clear labels for a namespace.

🧚 pprof 🧚

Provide golang pprof outputs for containerd — performance detective mode, lowkey iconic.

--debug-socket, -d="" — Socket path for containerd's debug server (default: /run/containerd/debug.sock).

🧵 block

Goroutine blocking profile.

--debug="" — Debug pprof args (default: 0).

🧶 goroutines

Dump goroutine stack dump.

--debug="" — Debug pprof args (default: 2).

🫧 heap

Dump heap profile.

--debug="" — Debug pprof args (default: 0).

🔥 profile

CPU profile.

--debug="" — Debug pprof args (default: 0).
--seconds, -s="" — Duration for collection (seconds) (default: 30s).

🪡 threadcreate

Goroutine thread creating profile.

--debug="" — Debug pprof args (default: 0).

🛰️ trace

Collect execution trace.

--debug="" — Debug pprof args (default: 0).
--seconds, -s="" — Trace time (seconds) (default: 5s).

run

okay bestie, this is THE command to run a container — the main character of ctr, no cap. ✨ here's every single flag so you can customize your little container baby exactly how you want. 💅

--allow-new-privs — turn off the OCI spec's NoNewPrivileges feature flag. lowkey spicy but sometimes you need it.
--annotation="" — add extra OCI annotations, like foo=bar. cute metadata vibes.
--apparmor-default-profile="" — turn on AppArmor with the default profile, using the name you give it, e.g. "cri-containerd.apparmor.d".
--apparmor-profile="" — turn on AppArmor with an already-existing custom profile. periodt.
--blockio-class="" — name of the blockio class to associate the container with.
--blockio-config-file="" — file path to blockio class definitions. by default, class definitions are not loaded. (so don't be surprised if it's empty 👀)
--cap-add="" — add Linux capabilities. set capabilities with the 'CAP_' prefix, bestie.
--cap-drop="" — drop Linux capabilities. also uses the 'CAP_' prefix.
--cgroup="" — cgroup path. to disable use of cgroup, set this to "" explicitly. yes, literally empty string. 💀
--cni — enable CNI networking for the container. networking slay.
--config, -c="" — path to the runtime-specific spec config file.
--cpu-period="" — limit CPU CFS period. (default: 0)
--cpu-quota="" — limit CPU CFS quota. (default: -1)
--cpu-shares="" — set the cpu shares. (default: 1024)
--cpus="" — set the CFS cpu quota. (default: 0.000000)
--cwd="" — specify the working directory of the process.
--detach, -d — detach from the task after it has started execution. cannot be used with --rm. (choose your fighter 🥊)
--device="" — file path to a device to add to the container; or a path to a directory tree of devices to add to the container. so many device options, iykyk.
--env="" — specify additional container environment variables, e.g. FOO=bar.
--env-file="" — specify additional container environment variables in a file, e.g. FOO=bar, one per line.
--fifo-dir="" — directory used for storing IO FIFOs.
--gidmap="" — run inside a user namespace with the specified GID mapping range. format is container-gid:host-gid:length. get those mappings right, bestie.
--gpus="" — add gpus to the container. gpu girlies rise up. 🎮
--hostname="" — set the container's host name.
--label="" — specify additional labels, e.g. foo=bar.
--log-uri="" — log uri. that's it. that's the tweet.
--memory-limit="" — memory limit (in bytes) for the container. (default: 0)
--mount="" — specify additional container mount, e.g. type=bind,src=/tmp,dst=/host,options=rbind:ro. mounts are iconic.
--net-host — enable host networking for the container. living on the edge.
--no-pivot — disable use of pivot-root (linux only).
--null-io — send all IO to /dev/null. bye bye output. 🙈
--pid-file="" — file path to write the task's pid.
--platform="" — run image for specific platform.
--privileged — run privileged container. highkey powerful, use responsibly.
--privileged-without-host-devices — don't pass all host devices to privileged container. a little less chaotic.
--rdt-class="" — name of the RDT class to associate the container with. specifies a Class of Service (CLOS) for cache and memory bandwidth management. fancy.
--read-only — set the container's filesystem as readonly. no writing, only vibes.
--remap-labels — provide the user namespace ID remapping to the snapshotter via label options; requires snapshotter support. don't forget that part.
--rm — remove the container after running. cannot be used with --detach. again, choose one. 💅
--rootfs — use custom rootfs that is not managed by containerd snapshotter. going rogue.
--rootfs-propagation="" — set the propagation of the container rootfs.
--runc-binary="" — specify runc-compatible binary.
--runc-root="" — specify runc-compatible root.
--runc-systemd-cgroup — start runc with systemd cgroup manager.
--runtime="" — runtime name or absolute path to runtime binary. (default: io.containerd.runc.v2)
--runtime-config-path="" — optional runtime config path.
--sandbox="" — create the container in the given sandbox.
--seccomp — enable the default seccomp profile.
--seccomp-profile="" — file path to custom seccomp profile. seccomp must be set to true before using seccomp-profile. important warning, bestie! ⚠️
--snapshotter="" — snapshotter name. empty value stands for the default value.
--snapshotter-label="" — labels added to the new snapshot for this container.
--tty, -t — allocate a TTY for the container. terminal girlies unite.
--uidmap="" — run inside a user namespace with the specified UID mapping range. format is container-uid:host-uid:length.
--user, -u="" — username or user id, group optional. (format: [:]) — yes, that's literally what the page says. 🙃
--with-ns="" — specify existing Linux namespaces to join at container runtime. (format: ':')

snapshots, snapshot

manage snapshots, the little frozen moments of your container life. 🎀

--snapshotter="" — snapshotter name. empty value stands for the default value.

commit

commit an active snapshot into the provided name. like saving your progress in a game. ✨

diff

get the diff of two snapshots. the default second snapshot is the first snapshot's parent. so sibling energy? no, parent energy. 😭

--keep — keep diff content. up to creator to delete it.
--label="" — labels to attach to the image.
--media-type="" — media type to use for creating diff. (default: application/vnd.oci.image.layer.v1.tar+gzip)
--ref="" — content upload reference to use.

info

get info about a snapshot. just the tea. 🍵

list, ls

list snapshots. the classic.

mounts, m, mount

mount gets mount commands for the snapshots. get those mounts!

prepare

prepare a snapshot from a committed snapshot. glow-up moment.

--mounts — print out snapshot mounts as JSON.
--target, -t="" — mount target path. will print mount if provided.

delete, del, remove, rm

remove snapshots. bye bestie. 👋

label

add labels to content.

tree

display tree view of snapshot branches. it's giving family tree but for snapshots. 🌳

unpack

unpack applies layers from a manifest to a snapshot.

--snapshotter="" — snapshotter name. empty value stands for the default value.

usage

usage snapshots. how much space are we talking?

-b — display size in bytes.

view

create a read-only snapshot from a committed snapshot.

--mounts — print out snapshot mounts as JSON.
--target, -t="" — mount target path. will print mount if provided.

tasks, t, task

manage tasks — the actual running processes inside your containers. this is where the action happens. 🔥

attach

attach to the IO of a running container. like sliding into their DMs but for input/output. 💬

checkpoint

checkpoint a container. freeze time, essentially. ⏸️

--exit — stop the container after the checkpoint.
--image-path="" — path to criu image files.
--work-path="" — path to criu work files and logs.

delete, del, remove, rm

delete one or more tasks. no cap, sometimes you gotta let go. 💀

--exec-id="" — process ID to kill.
--force, -f — force delete task process. aggressive but effective.

exec

execute additional processes in an existing container. like opening a new tab in your terminal. ✨

--cwd="" — working directory of the new process.
--detach, -d — detach from the task after it has started execution.
--exec-id="" — exec specific id for the process.
--fifo-dir="" — directory used for storing IO FIFOs.
--log-uri="" — log uri for custom shim logging.
--tty, -t — allocate a TTY for the container.
--user="" — user id or name.

list, ls

list tasks. see who's running the show.

--quiet, -q — print only the task id. minimalism slay.

kill

signal a container. (default: SIGTERM) — dramatic exit or gentle nudge, your choice. 💅

--all, -a — send signal to all processes inside the container.
--exec-id="" — process ID to kill.
--signal, -s="" — signal to send to the container.

metrics, metric

get a single data point of metrics for a task with the built-in Linux runtime. numbers girlies, this one's for you. 📊

--format="" — "table" or "json". (default: table)

pause

pause an existing container. brb, frozen. 🧊

ps

list processes for container. who's inside?

resume

resume a paused container. welcome back bestie. 🌸

start

start a container that has been created. it's alive! ⚡

--detach, -d — detach from the task after it has started execution.
--fifo-dir="" — directory used for storing IO FIFOs.
--log-uri="" — log uri.
--no-pivot — disable use of pivot-root (linux only).
--null-io — send all IO to /dev/null.
--pid-file="" — file path to write the task's pid.

install

install a new package. like apt install but for containerd things. 📦

--libs, -l — install libs from the image.
--path="" — set an optional install path other than the managed opt directory.
--replace, -r — replace any binaries or libs in the opt directory. out with the old, in with the new. 🔄

oci

OCI tools. the standards, the specs, the whole vibe. 🌐

spec

see the output of the default OCI spec. it's giving default settings.

--platform="" — platform of the spec to print. (Examples: 'linux/arm64', 'windows/amd64')

sandboxes, sandbox, sb, s

manage sandboxes. because sometimes you need a whole extra layer of isolation, bestie. 🏝️

run, create, c, r

run a new sandbox. fresh start energy. ✨

--runtime="" — runtime name. (default: io.containerd.runc.v2)

list, ls

list sandboxes. see all your little islands.

--filters="" — the list of filters to apply when querying sandboxes from the store.

remove, rm

remove sandboxes. goodbye island. 👋

--force, -f — ignore shutdown errors when removing sandbox.

info

print the server info. the lore. the backstory. 📖

deprecations

list

print warnings for deprecations. the "hey bestie, this is old" alerts. ⚠️

--format="" — output format to use. (Examples: 'default', 'json')

shim

interact with a shim directly. going straight to the source, no middleman. 💅

--id="" — container id.

delete

delete a container with a task. yeet. 🗑️

exec

exec a new process in the task's container. more processes, more fun.

--attach, -a — stay attached to the container and open the fifos.
--cwd="" — current working directory.
--env, -e="" — add environment vars.
--spec="" — runtime spec.
--stderr="" — specify the path to the stderr fifo.
--stdin="" — specify the path to the stdin fifo.
--stdout="" — specify the path to the stdout fifo.
--tty, -t — enable tty support.

start

start a container with a task. let's gooo. 🚀

state

get the state of all the processes of the task. the full status report. 📋

and that's a wrap! 🌈 this page came from ctr(8) with no version or date shown, so consider this your certified bestie-approved manual. now go slay those containers, periodt. 💖👑

📦 where this page comes from

opensuse-leap 16.0: containerd-ctr 1.7.33-160000.1.1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

CONTAINERD-CTR(8)

💅 ctr(8) — the containerd command, but make it a group chat

🎀 NAME

✨ SYNOPSIS

🌸 GLOBAL OPTIONS

👑 COMMANDS

🧩 plugins, plugin

list, ls

⭐ version

📦 containers, c, container

create

delete, del, remove, rm

info

list, ls

label

checkpoint

restore

🗄️ content

active

delete, del, remove, rm

edit

fetch

fetch-object

fetch-blob

get

ingest

list, ls

push-object

label

prune

references

🎉 events, event

🌈 images, image, i 🌈

🧐 check

📦 export

📥 import

📋 list, ls

🧷 mount

🪢 unmount

🚀 pull

🛫 push

🧹 prune

🗑️ delete, del, remove, rm

🏷️ tag

🔖 label

🔄 convert

📊 usage

🎫 leases 🎫

📋 list, ls

✨ create

🗑️ delete, del, remove, rm

🪐 namespaces, namespace, ns 🪐

✨ create, c

📋 list, ls

🗑️ remove, rm

🔖 label

🧚 pprof 🧚

🧵 block

🧶 goroutines

🫧 heap

🔥 profile

🪡 threadcreate

🛰️ trace

run

snapshots, snapshot

commit

diff

info

list, ls

mounts, m, mount

prepare

delete, del, remove, rm

label

tree

unpack

usage

view

tasks, t, task

attach

checkpoint

🧩 `plugins`, `plugin`

`list`, `ls`

⭐ `version`

📦 `containers`, `c`, `container`

`create`

`delete`, `del`, `remove`, `rm`

`info`

`list`, `ls`

`label`

`checkpoint`

`restore`

🗄️ `content`

`active`

`delete`, `del`, `remove`, `rm`

`edit`

`fetch`

`fetch-object`

`fetch-blob`

`get`

`ingest`

`list`, `ls`

`push-object`

`label`

`prune`

`references`

🎉 `events`, `event`