crio(8)

🌸 NAME 🌸

crio(8) — from the System Manager's Manual — is the OCI-based implementation of the Kubernetes Container Runtime Interface. That’s the whole name vibe, bestie: crio = OCI-based implementation of Kubernetes Container Runtime Interface. Periodt. ✨

🦋 SYNOPSIS 🦋

Okay so the shape is literally this, no cap:

crio

[--absent-mount-sources-to-reject]=[value]
[--add-inheritable-capabilities]
[--additional-artifact-stores]=[value]
[--additional-devices]=[value]
[--allowed-devices]=[value]
[--apparmor-profile]=[value]
[--auto-reload-registries]
[--big-files-temporary-dir]=[value]
[--bind-mount-prefix]=[value]
[--blockio-config-file]=[value]
[--blockio-reload]
[--cdi-spec-dirs]=[value]
[--cgroup-manager]=[value]
[--checkpoint-restore-level]=[value]
[--clean-shutdown-file]=[value]
[--cni-config-dir]=[value]
[--cni-default-network]=[value]
[--cni-plugin-dir]=[value]
[--cni-status-grace-period]=[value]
[--collection-period]=[value]
[--config-dir|-d]=[value]
[--config|-c]=[value]
[--conmon-cgroup]=[value]
[--conmon-env]=[value]
[--conmon]=[value]
[--container-attach-socket-dir]=[value]
[--container-exits-dir]=[value]
[--ctr-stop-timeout]=[value]
[--decryption-keys-path]=[value]
[--default-capabilities]=[value]
[--default-env]=[value]
[--default-mounts-file]=[value]
[--default-runtime]=[value]
[--default-sysctls]=[value]
[--default-transport]=[value]
[--default-ulimits]=[value]
[--device-ownership-from-security-context]
[--disable-hostport-mapping]
[--drop-infra-ctr]
[--enable-criu-support]
[--enable-metrics]
[--enable-nri]
[--enable-pod-events]
[--enable-profile-unix-socket]
[--enable-tracing]
[--gid-mappings]=[value]
[--global-auth-file]=[value]
[--grpc-max-recv-msg-size]=[value]
[--grpc-max-send-msg-size]=[value]
[--help|-h]
[--hooks-dir]=[value]
[--hostnetwork-disable-selinux]
[--image-volumes]=[value]
[--imagestore]=[value]
[--included-pod-metrics]=[value]
[--infra-ctr-cpuset]=[value]
[--internal-repair]
[--internal-wipe]
[--irqbalance-config-file]=[value]
[--irqbalance-config-restore-file]=[value]
[--listen]=[value]
[--log-dir]=[value]
[--log-filter]=[value]
[--log-format]=[value]
[--log-journald]
[--log-level|-l]=[value]
[--log-size-max]=[value]
[--log]=[value]
[--metrics-cert]=[value]
[--metrics-collectors]=[value]
[--metrics-host]=[value]
[--metrics-key]=[value]
[--metrics-port]=[value]
[--metrics-socket]=[value]
[--min-injected-gomaxprocs]=[value]
[--minimum-mappable-gid]=[value]
[--minimum-mappable-uid]=[value]
[--namespaces-dir]=[value]
[--no-pivot]
[--nri-disable-connections]
[--nri-enable-default-validator]
[--nri-listen]=[value]
[--nri-plugin-config-dir]=[value]
[--nri-plugin-dir]=[value]
[--nri-plugin-registration-timeout]=[value]
[--nri-plugin-request-timeout]=[value]
[--nri-validator-reject-custom-seccomp-adjustment]
[--nri-validator-reject-namespace-adjustment]
[--nri-validator-reject-oci-hook-adjustment]
[--nri-validator-reject-runtime-default-seccomp-adjustment]
[--nri-validator-reject-unconfined-seccomp-adjustment]
[--nri-validator-required-plugins]=[value]
[--nri-validator-tolerate-missing-plugins-annotation]=[value]
[--oci-artifact-mount-support]
[--pause-command]=[value]
[--pause-image-auth-file]=[value]
[--pause-image]=[value]
[--pids-limit]=[value]
[--pinned-images]=[value]
[--pinns-path]=[value]
[--privileged-seccomp-profile]=[value]
[--profile-cpu]=[value]
[--profile-mem]=[value]
[--profile-port]=[value]
[--profile]
[--pull-progress-timeout]=[value]
[--rdt-config-file]=[value]
[--read-only]
[--root|-r]=[value]
[--runroot]=[value]
[--runtimes]=[value]
[--seccomp-profile]=[value]
[--selinux]
[--separate-pull-cgroup]=[value]
[--shared-cpuset]=[value]
[--short-name-mode]=[value]
[--signature-policy-dir]=[value]
[--signature-policy]=[value]
[--stats-collection-period]=[value]
[--storage-driver|-s]=[value]
[--storage-opt]=[value]
[--stream-address]=[value]
[--stream-enable-tls]
[--stream-idle-timeout]=[value]
[--stream-port]=[value]
[--stream-tls-ca]=[value]
[--stream-tls-cert]=[value]
[--stream-tls-key]=[value]
[--timezone|--tz]=[value]
[--tls-cipher-suites]=[value]
[--tls-min-version]=[value]
[--tracing-endpoint]=[value]
[--tracing-sampling-rate-per-million]=[value]
[--uid-mappings]=[value]
[--version-file-persist]=[value]
[--version-file]=[value]
[--version|-v]

💅 DESCRIPTION 💅

So crio is an OCI-based implementation of Kubernetes Container Runtime Interface Daemon. It’s literally here to give you an integration path between OCI conformant runtimes and the kubelet. Specifically — and this is the main character energy — it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes. The scope of crio is tied to the scope of the CRI. 🫶

Here’s the CRI scope checklist, bestie:

1. Support multiple image formats including the existing Docker and OCI image formats.
2. Support for multiple means to download images including trust & image verification.
3. Container image management (managing image layers, overlay filesystems, etc).
4. Container process lifecycle management.
5. Monitoring and logging required to satisfy the CRI.
6. Resource isolation as required by the CRI.

Usage, fr fr:

crio [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]

🔥 GLOBAL OPTIONS 🔥

• --absent-mount-sources-to-reject="" — A list of paths that, when absent from the host, will cause a container creation to fail (as opposed to the current behavior of creating a directory). It’s giving “strict host path vibe check.” 💀
• --add-inheritable-capabilities — Add capabilities to the inheritable set, as well as the default group of permitted, bounding and effective. Capability slay. ✨
• --additional-artifact-stores="" — Additional read-only OCI artifact store paths.
• --additional-devices="" — Devices to add to the containers.
• --allowed-devices="" — Devices a user is allowed to specify with the "devices.crio.io" allowed annotation. (default: "/dev/fuse", "/dev/net/tun") 🎀
• --apparmor-profile="" — Name of the apparmor profile to be used as the runtime’s default. This only takes effect if the user does not specify a profile via the Kubernetes Pod’s metadata annotation. (default: "crio-default") 💅
• --auto-reload-registries — If true, CRI-O will automatically reload the mirror registry when there is an update to the 'registries.conf.d' directory. Default value is set to 'false'. So lowkey it’s off unless you turn it on. 🦋
• --big-files-temporary-dir="" — Path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management. Big files need a big-files temp home, periodt.
• --bind-mount-prefix="" — A prefix to use for the source of the bind mounts. This option would be useful if you were running CRI-O in a container. And had / mounted on /host in your container. Then if you ran CRI-O with the --bind-mount-prefix=/host option, CRI-O would add /host to any bind mounts it is handed over CRI. If Kubernetes asked to have /var/lib/foobar bind mounted into the container, then CRI-O would bind mount /host/var/lib/foobar. Since CRI-O itself is running in a container with / or the host mounted on /host, the container would end up with /var/lib/foobar from the host mounted in the container rather than /var/lib/foobar from the CRI-O container. That’s the whole plot. 🫶
• --blockio-config-file="" — Path to the blockio class configuration file for configuring the cgroup blockio controller.
• --blockio-reload — Reload blockio-config-file and rescan blockio devices in the system before applying blockio parameters. Fresh scan, fresh blockio vibes. 🔥
• --cdi-spec-dirs="" — Directories to scan for CDI Spec files. (default: "/etc/cdi", "/run/cdi") 🎀
• --cgroup-manager="" — cgroup manager (cgroupfs or systemd). (default: "systemd")
• --checkpoint-restore-level="" — The level of container checkpoint/restore support to enable. Must be one of "none", "checkpoint_only" or "checkpoint_restore". Enabling checkpoint or restore requires that the criu binary is available in $PATH. (default: "checkpoint_only") ⭐
• --clean-shutdown-file="" — Location for CRI-O to lay down the clean shutdown file. It indicates whether we’ve had time to sync changes to disk before shutting down. If not found, crio wipe will clear the storage directory. (default: "/var/lib/crio/clean.shutdown") 😭
• --cni-config-dir="" — CNI configuration files directory. (default: "/etc/cni/net.d/")
• --cni-default-network="" — Name of the default CNI network to select. If not set or "", then CRI-O will pick-up the first one found in --cni-config-dir. First found = main character network, iykyk. 🦋
• --cni-plugin-dir="" — CNI plugin binaries directory.
• --cni-status-grace-period="" — Enable continuous CNI STATUS monitoring with the given grace period. When set to 0 (default), monitoring is disabled and plugin health is only determined at startup. When set to a positive duration (e.g. 1m), a background goroutine polls the plugin every 5s and waits for this grace period before marking the node not-ready. (default: 0s) 🫶
• --collection-period="" — The number of seconds between collecting pod/container stats and pod sandbox metrics. If set to 0, the metrics/stats are collected on-demand instead. (default: 0)
• --config, -c="" — Path to configuration file. (default: "/etc/crio/crio.conf") 🎀
• --config-dir, -d="" — Path to the configuration drop-in directory. This directory will be recursively iterated and each file gets applied to the configuration in their processing order. This means that a configuration file named 00-default has a lower priority than a file named 01-my-overwrite. The global config file, provided via --config,-c or per default in /etc/crio/crio.conf, always has a lower priority than the files in the directory specified by --config-dir,-d. Besides that, provided command line parameters have a higher priority than any configuration file. (default: "/etc/crio/crio.conf.d") ✨
• --conmon="" — Path to the conmon binary, used for monitoring the OCI runtime. Will be searched for using $PATH if empty. This option is deprecated, and will be removed in the future. 🚨
• --conmon-cgroup="" — cgroup to be used for conmon process. This option is deprecated and will be removed in the future. 🚨
• --conmon-env="" — Environment variable list for the conmon process, used for passing necessary environment variables to conmon or the runtime. This option is deprecated and will be removed in the future. 🚨
• --container-attach-socket-dir="" — Path to directory for container attach sockets. (default: "/run/crio")
• --container-exits-dir="" — Path to directory in which container exit files are written to by conmon. (default: "/run/crio/exits") 💜
• --ctr-stop-timeout="value" — how many seconds we're willing to wait before we go "ok timeout bestie" on a container that's supposed to be terminating properly. The lowest possible value is 30s, and anything lower just gets ignored by CRI-O, no cap. (default: 30)
• --decryption-keys-path="value" — where to load the keys for decrypting images 🔐. (default: "/etc/crio/keys/")
• --default-capabilities="value" — the capabilities we hand to containers by default, like a lil starter pack of privileges 🎀. (default: "CHOWN", "DAC_OVERRIDE", "FSETID", "FOWNER", "SETGID", "SETUID", "SETPCAP", "NET_BIND_SERVICE", "KILL")
• --default-env="value" — extra environment variables set for all the containers. yes, all of them, matching outfits 💖.
• --default-mounts-file="value" — path to the default mounts file.
• --default-runtime="value" — the default OCI runtime, picked from the runtimes config. (default: "crun")
• --default-sysctls="value" — sysctls to add to the containers.
• --default-transport="value" — a prefix that gets prepended to image names that can't be pulled as-is (iykyk). (default: "docker://")
• --default-ulimits="value" — ulimits applied to containers by default, in name=soft:hard form.
• --device-ownership-from-security-context — set devices' uid/gid ownership from runAsUser/runAsGroup. cute and consistent ✨.
• --disable-hostport-mapping — if true, CRI-O disables the hostport mapping. fr, it just turns it off.
• --drop-infra-ctr — decides whether pods get created without an infra container, but only when the pod isn't using a pod level PID namespace. very specific vibe check 👑.
• --enable-criu-support — enables CRIU integration, which requires the criu binary to be available in $PATH. DEPRECATED: use the container_level_enabled option in the crio.checkpoint_restore table instead. When set to false it's translated to container_level_enabled = "none".
• --enable-metrics — enables the metrics endpoint for the server. numbers go brrr 📈.
• --enable-nri — enables NRI (Node Resource Interface) support.
• --enable-pod-events — if true, CRI-O starts sending the container events to the kubelet.
• --enable-profile-unix-socket — enables the pprof profiler on the crio unix domain socket.
• --enable-tracing — enables OpenTelemetry trace data exporting 🦋.
• --gid-mappings="value" — specify the GID mappings to use for the user namespace. This option is deprecated, and will be replaced with Kubernetes user namespace (KEP-127) support in the future.
• --global-auth-file="value" — path to a file like /var/lib/kubelet/config.json holding the credentials you need for pulling images from secure registries 🔑.
• --grpc-max-recv-msg-size="value" — maximum grpc receive message size in bytes. (default: 16777216)
• --grpc-max-send-msg-size="value" — maximum grpc send message size in bytes. (default: 16777216)
• --help, -h — show help 🫶.
• --hooks-dir="value" — set the OCI hooks directory path (may be set multiple times). (default: "/usr/share/containers/oci/hooks.d")
  • If one of the directories does not exist, then CRI-O will automatically skip them. no drama, no error 💅.
  • Each *.json file in the path configures a hook for CRI-O containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). CRI-O currently supports both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated.
  • This option may be set multiple times; paths from later options have higher precedence (oci-hooks(5) discusses directory precedence).
  • For the annotation conditions, CRI-O uses the Kubernetes annotations, which are a subset of the annotations passed to the OCI runtime. For example, io.kubernetes.cri-o.Volumes is part of the OCI runtime configuration annotations, but it is not part of the Kubernetes annotations being matched for hooks. sneaky distinction, remember it 🌸.
  • For the bind-mount conditions, only mounts explicitly requested by Kubernetes configuration are considered. Bind mounts that CRI-O inserts by default (e.g. /dev/shm) are not considered.
• --hostnetwork-disable-selinux — determines whether SELinux should be disabled within a pod when it's running in the host network namespace.
• --image-volumes="value" — image volume handling, and you've got exactly three choices: mkdir, bind, or ignore. (default: "mkdir")
  1. mkdir: a directory is created inside the container root filesystem for the volumes.
  2. bind: a directory is created inside the container state directory and bind mounted into the container for the volumes.
  3. ignore: all volumes are just ignored and no action is taken. literally "not my problem" 💀.
• --imagestore="value" — store newly pulled images in the specified path, rather than the path provided by --root. Defaults to the value from containers/storage configuration.
• --included-pod-metrics="value" — a list of pod metrics to include. you literally just specify the names of the metrics you want in this list ✨.
• --infra-ctr-cpuset="value" — CPU set to run infra containers. if you don't specify it, CRI-O will use all online CPUs to run infra containers.
• --internal-repair — if true, CRI-O will check whether the container and image storage was corrupted after a sudden restart, and attempt to repair the storage if it was. self-care for your storage 🩹.
• --internal-wipe — whether CRI-O should wipe containers after a reboot and images after an upgrade when the server starts. If set to false, one must run crio wipe to wipe the containers and images in these situations. This option is deprecated, and will be removed in the future.
• --irqbalance-config-file="value" — the irqbalance service config file which is used by CRI-O. (default: "/etc/sysconfig/irqbalance")
• --irqbalance-config-restore-file="value" — determines if CRI-O should attempt to restore the irqbalance config at startup with the mask in this file. Use the disable value to disable the restore flow entirely. (default: "/etc/sysconfig/orig_irq_banned_cpus")
• --listen="value" — path to the CRI-O socket. (default: "/run/crio/crio.sock")
• --log="value" — set the log file path where internal debug information gets written.
• --log-dir="value" — default log directory where all logs will go unless directly specified by the kubelet. (default: "/var/log/crio/pods")
• --log-filter="value" — filter the log messages by the provided regular expression. For example request.* filters all gRPC requests. so satisfying 🔍.
• --log-format="value" — set the format used by logs: text or json. (default: "text")
• --log-journald — log to systemd journal (journald) in addition to the kubernetes log file. double logging, double the fun ✨.
• --log-level, -l="value" — log messages above the specified level: trace, debug, info, warn, error, fatal or panic. (default: "info")
• --log-size-max="value" — maximum log size in bytes for a container. If it's positive, it must be >= 8192 to match/exceed the conmon read buffer. This option is deprecated. The Kubelet flag --container-log-max-size should be used instead. (default: -1)
• --metrics-cert="value" — certificate for the secure metrics endpoint 🎀.
• --metrics-collectors="value" — the enabled metrics collectors. (default: "image_pulls_layer_size", "containers_events_dropped_total", "containers_oom_total", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total", "containers_seccomp_notifier_count_total", "resources_stalled_at_stage", "containers_stopped_monitor_count", "default_runtime")
• --metrics-host="value" — host for the metrics endpoint. (default: "127.0.0.1")
• --metrics-key="value" — certificate key for the secure metrics endpoint 🔐.
• --metrics-port="value" — port for the metrics endpoint. (default: 9090)
• --metrics-socket="value" — socket for the metrics endpoint.
• --min-injected-gomaxprocs="value" — enable GOMAXPROCS injection. Burstable pods auto-calculate from CPU request, with this value as the minimum floor. Best-effort pods use this value directly. 0 to disable. (default: 0)
• --minimum-mappable-gid="value" — specify the lowest host GID which can be specified in mappings for a pod that will be run as a UID other than 0. This option is deprecated, and will be replaced with Kubernetes user namespace support (KEP-127) in the future. (default: -1)
• --minimum-mappable-uid="value" — specify the lowest host UID which can be specified in mappings for a pod that will be run as a UID other than 0. This option is deprecated, and will be replaced with Kubernetes user namespace support (KEP-127) in the future. (default: -1)
• --namespaces-dir="value" — the directory where the state of the managed namespaces gets tracked. Only used when manage-ns-lifecycle is true. (default: "/run")
• --no-pivot — if true, the runtime will not use pivot_root, but instead use MS_MOVE. big switch energy 👀.
• --nri-disable-connections — disable connections from externally started NRI plugins. sorry bestie, door's closed 🚪.
• --nri-enable-default-validator — enable the default NRI validator plugin ✨.
• --nri-listen="value" — socket to listen on for externally started NRI plugins to connect to. (default: "/run/nri/nri.sock")
• --nri-plugin-config-dir="value" — directory to scan for configuration of pre-installed NRI plugins. (default: "/etc/nri/conf.d")
• --nri-plugin-dir="value" — directory to scan for pre-installed NRI plugins to start automatically. (default: "/opt/nri/plugins")
• --nri-plugin-registration-timeout="value" — timeout for a plugin to register itself with NRI. (default: 5s)
• --nri-plugin-request-timeout="value" — timeout for a plugin to handle an NRI request. (default: 2s)
• --nri-validator-reject-custom-seccomp-adjustment — reject NRI plugin adjustment of custom seccomp policy. nope, not today 💅.
• --nri-validator-reject-namespace-adjustment — reject NRI plugin adjustment of linux namespaces.
• --nri-validator-reject-oci-hook-adjustment — reject NRI plugin adjustment of OCI Hooks.
• --nri-validator-reject-runtime-default-seccomp-adjustment — reject NRI plugin adjustment of runtime default seccomp policy.
• --nri-validator-reject-unconfined-seccomp-adjustment — reject NRI plugin adjustment of unconfined seccomp policy.
• --nri-validator-required-plugins="value" — list of required NRI plugins that must be present. no skips allowed 🫶.
• --nri-validator-tolerate-missing-plugins-annotation="value" — name of the annotation used to indicate toleration of missing required NRI plugins.
• --oci-artifact-mount-support — if true, CRI-O can mount OCI artifacts as volumes. iconic 💖.
• --pause-command="value" — path to the pause executable in the pause image. (default: "/pause")
• --pause-image="value" — image which contains the pause executable. (default: "registry.k8s.io/pause:3.10.2")
• --pause-image-auth-file="value" — path to a config file containing credentials for --pause-image 🔑.
• --pids-limit="value" — maximum number of processes allowed in a container. This option is deprecated. The Kubelet flag --pod-pids-limit should be used instead. (default: -1)
• --pinned-images="value" — a list of images and OCI artifacts that will be excluded from the kubelet's garbage collection. protected. untouchable. main character images 👑.
• --pinns-path="value" — the path to find the pinns binary, which is needed to manage namespace lifecycle. Will be searched for in $PATH if empty.
• --privileged-seccomp-profile="" — gives privileged containers a seccomp profile too, loaded from a local path ✨ like, yes, even the privileged ones get a lil guardrail.
• --profile — turns on the pprof remote profiler, listening on 127.0.0.1:6060 🔥
• --profile-cpu="" — writes a pprof CPU profile out to the path you give it.
• --profile-mem="" — same energy but for a pprof memory profile 💖 drop the path, get the file.
• --profile-port="" — the port the pprof profiler lives on. (default: 6060)
• --pull-progress-timeout="" — how long an image pull gets to make progress before the whole pull operation gets canceled 😭 this value is also used to compute the pull progress interval as --pull-progress-timeout / 10. Set it to 0 and you disable the timeout and the progress output. (default: 0s)
• --rdt-config-file="" — path to the RDT config file, for configuring the resctrl pseudo-filesystem 🧚
• --read-only — sets up all unprivileged containers to run read-only. It automatically mounts the containers' tmpfs on /run, /tmp and /var/tmp. no cap, that's the whole thing 💅
• --root, -r="" — the CRI-O root directory 🏠 defaults to whatever value comes from the containers/storage configuration.
• --runroot="" — the CRI-O state directory. also defaults to the value from the containers/storage configuration.
• --runtimes="" — OCI runtimes! the format is literally 'runtime_name:runtime_path:runtime_root:runtime_type:privileged_without_host_devices:runtime_config_path:container_min_memory' — copy it exactly bestie, it's giving colon-separated chaos 🎀
• --seccomp-profile="" — path to the seccomp.json profile used as the runtime's default. if you don't specify one, the internal default seccomp profile gets used ✨
• --selinux — enables SELinux support. ⚠️ this option is deprecated, and in the future it will be interpreted from whether SELinux is enabled on the host.
• --separate-pull-cgroup="" — [EXPERIMENTAL] pull in a new cgroup 🧪
• --shared-cpuset="" — the CPU set that guaranteed containers wanting access to shared CPUs will use.
• --short-name-mode="" — describes the mode of short name resolution. allowed values are 'enforcing' and 'disabled'. (default: "enforcing")
• --signature-policy="" — path to the signature policy JSON file 📄
• --signature-policy-dir="" — path to the root directory for namespaced signature policies. must be an absolute path. (default: "/etc/crio/policies")
• --stats-collection-period="" — how many seconds between collecting pod and container stats ⏱️ if it's set to 0, stats get collected on-demand instead. DEPRECATED: this option will be removed in the future. (default: 0)
• --storage-driver, -s="" — OCI storage driver. defaults to the value from the containers/storage configuration.
• --storage-opt="" — OCI storage driver option. defaults to the value from the containers/storage configuration.
• --stream-address="" — bind address for the streaming socket. (default: "127.0.0.1")
• --stream-enable-tls — enables encrypted TLS transport for the stream server 🔐
• --stream-idle-timeout="" — how long open streams stay open before they terminate from lack of activity 💤
• --stream-port="" — bind port for the streaming socket. if the port is '0', CRI-O allocates a random free port number for you. (default: "0")
• --stream-tls-ca="" — path to the x509 CA(s) file used to verify and authenticate client communication with the encrypted stream. this file can change, and CRI-O will automatically pick up the changes 👀
• --stream-tls-cert="" — path to the x509 certificate file used to serve the encrypted stream. can change, auto-picked-up, same deal 🌸
• --stream-tls-key="" — path to the key file used to serve the encrypted stream. also can change, also auto-picked-up 🔑
• --timezone, --tz="" — sets the timezone for a container in CRI-O 🌍 if you pass an empty string, CRI-O retains its default behavior. use 'Local' to match the timezone of the host machine.
• --tls-cipher-suites="" — comma-separated list of cipher suites for TLS 1.2.
• --tls-min-version="" — minimum TLS version for the streaming and metrics servers (VersionTLS12 or VersionTLS13). (default: "VersionTLS12")
• --tracing-endpoint="" — address the gRPC tracing collector listens on. (default: "127.0.0.1:4317")
• --tracing-sampling-rate-per-million="" — how many samples to collect per million OpenTelemetry spans. set it to 1000000 to always sample 😤 (default: 0)
• --uid-mappings="" — specify the UID mappings for the user namespace. ⚠️ this option is deprecated and will be replaced with Kubernetes user namespace support (KEP-127) in the future.
• --version, -v — print the version 👑
• --version-file="" — where CRI-O lays down the temporary version file. it's used to check if crio wipe should wipe containers, which should always happen on a node reboot. (default: "/run/crio/version")
• --version-file-persist="" — where CRI-O lays down the persistent version file. it's used to check if crio wipe should wipe images — which should only happen when CRI-O has been upgraded. (default: "/run/crio/version"... ok no, there's no default listed for this one, don't @ me)

---

🌈 COMMANDS 🌈

🩺 check

check the CRI-O storage directory for errors 🔍

this command can also repair damaged containers, images and layers — it's not just a hater, it fixes things too 🫶

by default the data integrity of the storage directory is verified, which can be an I/O and CPU-intensive operation 😮‍💨 the --quick option can be used to reduce the number of checks run.

when you're using --repair, and especially with --force, CRI-O and any currently running containers should be stopped if possible, so no concurrent access to the storage directory happens 💀 like, don't fight over the same directory bestie.

the --wipe option can be used to automatically attempt to remove containers and images on a repair failure. this option, combined with --force, can be used to entirely remove the storage directory content in case of irrecoverable errors. that is a last resort 🙈 and same as --repair, it's best if CRI-O and any currently running containers are stopped.

• --age, -a="" — maximum allowed age for unreferenced layers (default: "24h")
• --force, -f — remove damaged containers
• --quick, -q — perform only quick checks ⚡
• --repair, -r — remove damaged images and layers
• --wipe, -w — wipe the storage directory on repair failure

🐚 complete, completion

generate bash, fish or zsh completions ✨ tab-completion is self care, periodt.

⚙️ config

outputs a commented version of the configuration file that CRI-O could use 💖 this lets you save your current configuration setup and then load it later with --config. global options will modify the output, iykyk.

• --default — output the default configuration (without taking into account any configuration options) 🎀

📖 man

generate the man page documentation. yes, the thing you're literally reading rn 😭 meta.

📝 markdown, md

generate the markdown documentation.

• --help, -h — show help

💬 help, h

shows a list of commands or help for one command.

📊 status

display status information.

• --socket, -s="" — absolute path to the unix socket (default: "/run/crio/crio.sock")

🧾 config, c

show the configuration of CRI-O as a TOML string.

📦 containers, container, cs, s

display detailed information about the provided container ID 👑

• --id, -i="" — the container ID

ℹ️ info, i

retrieve generic information about CRI-O, such as the cgroup and storage driver.

🧵 goroutines, g

display the goroutine stack.

🗑️ heap, hp

write the heap dump to a temp file and print its location on disk 🫶

• --file, -f="" — output file of the heap dump.

🏷️ version

display detailed version information.

• --json, -j — print JSON instead of text
• --verbose, -v — print verbose information (for example all golang dependencies) 😮‍💨 yes, all of them.

🧹 wipe

wipe CRI-O's container and image storage.

• --force, -f — force wipe by skipping the version check

💬 help, h

shows a list of commands or help for one command.

---

📁 FILES 📁

• crio.conf (/etc/crio/crio.conf) — cri-o configuration file for all of the available command-line options for the crio(8) program, but in a TOML format that can be more easily modified and versioned 💅
• policy.json (/etc/containers/policy.json) — signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid 🎀
• registries.conf (/etc/containers/registries.conf) — registry configuration file. specifies the registries which are consulted when completing image names that do not include a registry or domain portion 🌸
• storage.conf (/etc/containers/storage.conf) — storage configuration file. specifies all of the available container storage options for tools using shared container storage 📦

---

🌱 ENVIRONMENT 🌱

all command-line options may also be specified as environment variables. the options detailed down here, though, can only be set via environment variables 👀

• KUBENSMNT — path to a bind-mounted mount namespace that CRI-O should join before launching any containers. if the path doesn't exist, or doesn't point to a mount namespace bindmount, CRI-O will run in its parent's mount namespace and log a warning that the requested namespace was not joined ⚠️

---

👀 SEE ALSO 👀

crio.conf(5), crio.conf.d(5), oci-hooks(5), policy.json(5), registries.conf(5), storage.conf(5)

go read those too bestie, they're the whole friend group 🫶

---

and that's the page!! 🎀 this whole thing is crio(8) — that's your source, that's the name at the bottom of the page, and honestly the version-and-date footer energy is just me blowing you a kiss from the terminal ✨ you read the entire manual, I'm so proud of you, icon behavior fr fr 💜