Kubernetes with containerd
Run Kubernetes Pods through containerd using the Container Runtime Interface with aligned cgroups, registry configuration and node operations.
Integration boundary
The kubelet calls containerd through CRI to pull images, create sandboxes and manage containers while Kubernetes retains orchestration state.
Supported approaches
Package-managed containerd
Install a supported containerd release and configure its CRI plugin on each node.
Managed Kubernetes runtime
Use the provider-managed containerd configuration and supported node-image lifecycle.
Prerequisites
- Compatible Kubernetes and containerd versions
- Matching cgroup driver strategy
- Working CNI plugin
- Registry and sandbox-image access from every node
Implementation
Configure CRI
Ensure the CRI plugin is enabled and kubelet points to the correct runtime endpoint.
Align cgroups
Use the recommended systemd cgroup driver consistently between kubelet and runtime on systemd hosts.
Define registry trust
Configure mirrors, authentication and private certificate authorities through supported containerd mechanisms.
Verification
Check CRI status
Query the runtime through the CRI-compatible tooling used for node diagnosis.
crictl info
Inspect node readiness
Confirm runtime and network readiness in Node conditions and kubelet events.
kubectl describe node <node>
Run a pull test
Schedule a controlled Pod using the same registry path and architecture as production images.
Common failure modes
- CRI plugin disabled
- Kubelet and runtime cgroup drivers disagree
- Registry configuration uses deprecated layout
- Operating with ctr instead of CRI-aware diagnostics
Follow Kubernetes and containerd failures and fixes
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.