crio(8) System Manager's Manual crio(8) (NAME) crio - OCI (CRI) (SYNOPSIS) crio [--absent-mount-sources-to-reject]=[value] [--add-inheritable-capabilities] [--additional-artifact-stores]=[value] [--additional-devices]=[value] [--allowed-devices]=[value] [--apparmor-profile]=[value] [--auto-reload-registries] [--big-files-temporary-dir]=[value] [--bind-mount-prefix]=[value] [--blockio-config-file]=[value] [--blockio-reload] [--cdi-spec-dirs]=[value] [--cgroup-manager]=[value] [--clean-shutdown-file]=[value] [--cni-config-dir]=[value] [--cni-default-network]=[value] [--cni-plugin-dir]=[value] [--cni-status-grace-period]=[value] [--collection-period]=[value] [--config-dir|-d]=[value] [--config|-c]=[value] [--conmon-cgroup]=[value] [--conmon-env]=[value] [--conmon]=[value] [--container-attach-socket-dir]=[value] [--container-exits-dir]=[value] [--ctr-stop-timeout]=[value] [--decryption-keys-path]=[value] [--default-capabilities]=[value] [--default-env]=[value] [--default-mounts-file]=[value] [--default-runtime]=[value] [--default-sysctls]=[value] [--default-transport]=[value] [--default-ulimits]=[value] [--device-ownership-from-security-context] [--disable-hostport-mapping] [--drop-infra-ctr] [--enable-criu-support] [--enable-metrics] [--enable-nri] [--enable-pod-events] [--enable-profile-unix-socket] [--enable-tracing] [--gid-mappings]=[value] [--global-auth-file]=[value] [--grpc-max-recv-msg-size]=[value] [--grpc-max-send-msg-size]=[value] [--help|-h] [--hooks-dir]=[value] [--hostnetwork-disable-selinux] [--image-volumes]=[value] [--imagestore]=[value] [--included-pod-metrics]=[value] [--infra-ctr-cpuset]=[value] [--insecure-registry]=[value] [--internal-repair] [--internal-wipe] [--irqbalance-config-file]=[value] [--irqbalance-config-restore-file]=[value] [--listen]=[value] [--log-dir]=[value] [--log-filter]=[value] [--log-format]=[value] [--log-journald] [--log-level|-l]=[value] [--log-size-max]=[value] [--log]=[value] [--metrics-cert]=[value] [--metrics-collectors]=[value] [--metrics-host]=[value] [--metrics-key]=[value] [--metrics-port]=[value] [--metrics-socket]=[value] [--min-injected-gomaxprocs]=[value] [--minimum-mappable-gid]=[value] [--minimum-mappable-uid]=[value] [--namespaces-dir]=[value] [--no-pivot] [--nri-disable-connections] [--nri-enable-default-validator] [--nri-listen]=[value] [--nri-plugin-config-dir]=[value] [--nri-plugin-dir]=[value] [--nri-plugin-registration-timeout]=[value] [--nri-plugin-request-timeout]=[value] [--nri-validator-reject-custom-seccomp-adjustment] [--nri-validator-reject-namespace-adjustment] [--nri-validator-reject-oci-hook-adjustment] [--nri-validator-reject-runtime-default-seccomp-adjustment] [--nri-validator-reject-unconfined-seccomp-adjustment] [--nri-validator-required-plugins]=[value] [--nri-validator-tolerate-missing-plugins-annotation]=[value] [--oci-artifact-mount-support] [--pause-command]=[value] [--pause-image-auth-file]=[value] [--pause-image]=[value] [--pids-limit]=[value] [--pinned-images]=[value] [--pinns-path]=[value] [--privileged-seccomp-profile]=[value] [--profile-cpu]=[value] [--profile-mem]=[value] [--profile-port]=[value] [--profile] [--pull-progress-timeout]=[value] [--rdt-config-file]=[value] [--read-only] [--root|-r]=[value] [--runroot]=[value] [--runtimes]=[value] [--seccomp-profile]=[value] [--selinux] [--separate-pull-cgroup]=[value] [--shared-cpuset]=[value] [--short-name-mode]=[value] [--signature-policy-dir]=[value] [--signature-policy]=[value] [--stats-collection-period]=[value] [--storage-driver|-s]=[value] [--storage-opt]=[value] [--stream-address]=[value] [--stream-enable-tls] [--stream-idle-timeout]=[value] [--stream-port]=[value] [--stream-tls-ca]=[value] [--stream-tls-cert]=[value] [--stream-tls-key]=[value] [--timezone|--tz]=[value] [--tls-cipher-suites]=[value] [--tls-min-version]=[value] [--tracing-endpoint]=[value] [--tracing-sampling-rate-per-million]=[value] [--uid-mappings]=[value] [--version-file-persist]=[value] [--version-file]=[value] [--version|-v] (DESCRIPTION) (CRI) OCI crio OCI kubelet . (CRI) OCI . crio CRI : 1. Docker OCI. 2. . 3. ( overlay ). 4. . 5. () CRI. 6. CRI. (Usage): crio [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...] (GLOBAL OPTIONS) --absent-mount-sources-to-reject="": ( ). --add-inheritable-capabilities: (inheritable) (permitted) (bounding) (effective). --additional-artifact-stores="": OCI. --additional-devices="": . --allowed-devices="": "io.kubernetes.cri-o.Devices" . (: "/dev/fuse", "/dev/net/tun") --apparmor-profile="": apparmor . . (: "crio-default") --auto-reload-registries: true 'registries.conf.d' CRI- O . 'false' . --big-files-temporary-dir="": blob . --bind-mount-prefix="": (bind mounts). CRI-O '/' '/host' . CRI-O '--bind-mount-prefix=/host' CRI-O /host bind mount CRI . '/var/lib/foobar' bind CRI-O '/host/var/lib/foobar' . CRI-O '/' '/host' '/var/lib/foobar' '/var/lib/foobar' CRI-O. --blockio-config-file="": blockio blockio cgroup. --blockio-reload: blockio-config-file blockio blockio. --cdi-spec-dirs="": CDI. (: "/etc/cdi", "/run/cdi") --cgroup-manager="": cgroup ( cgroupfs systemd). (: "systemd") --clean-shutdown-file="": CRI-O . . crio wipe . (: "/var/lib/crio/clean.shutdown") --cni-config-dir="": CNI. (: "/etc/cni/net.d/") --cni-default-network="": CNI . "" CRI-O --cni- config-dir . --cni-plugin-dir="": CNI. --cni-status-grace-period="": CNI . 0 () . ( 1m) goroutine 5 (not-ready) . (: 0s) --collection-period="": / . 0 / . (: 0) --config, -c="": (: "/etc/crio/crio.conf") --config-dir, -d="": drop-in . . '00-default' '01-my-overwrite' . '--config,-c' /etc/crio/crio.conf '--config-dir,-d' . . (: "/etc/crio/crio.conf.d") --conmon="": conmon OCI. $PATH . . --conmon-cgroup="": cgroup conmon. . --conmon-env="": conmon conmon . . --container-attach-socket-dir="": . (: "/run/crio") --container-exits-dir="": conmon . (: "/run/crio/exits") --ctr-stop-timeout="": . 30s CRI-O . (: 30) --decryption-keys-path="": . (: "/etc/crio/keys/") --default-capabilities="": . (: "CHOWN", "DAC_OVERRIDE", "FSETID", "FOWNER", "SETGID", "SETUID", "SETPCAP", "NET_BIND_SERVICE", "KILL") --default-env="": . --default-mounts-file="": . --default-runtime="": OCI runtimes. (: "crun") --default-sysctls="": sysctl . --default-transport="": . (: "docker://") --default-ulimits="": ulimit (name=soft:hard). --device-ownership-from-security-context: uid/gid runAsUser/runAsGroup. --disable-hostport-mapping: true CRI-O hostport . --drop-infra-ctr: PID infra . --enable-criu-support: CRIU criu $PATH . --enable-metrics: (metrics) . --enable-nri: NRI ( ). --enable-pod-events: true CRI-O kubelet . --enable-profile-unix-socket: pprof crio. --enable-tracing: (trace) OpenTelemetry. --gid-mappings="": GID . (KEP-127) . --global-auth-file="": /var/lib/kubelet/config.json . --grpc-max-recv-msg-size="": gRPC . (: 83886080) --grpc-max-send-msg-size="": gRPC . (: 83886080) --help, -h: --hooks-dir="": OCI ( ). CRI-O . '*.json' CRI-O . JSON 'oci-hooks(5)' . CRI-O 1.0.0 0.1.0 0.1.0 . ('oci-hooks(5)' ). CRI- O OCI . 'io.kubernetes.cri-o.Volumes' OCI . (bind- mount) . CRI-O ( '/dev/shm') . (: "/usr/share/containers/oci/hooks.d") --hostnetwork-disable-selinux: SELinux . --image-volumes="": ('mkdir' 'bind' 'ignore') 1. mkdir: . 2. bind: bind . 3. ignore: . (: "mkdir") --imagestore="": --root. --included-pod-metrics="": . . --infra-ctr-cpuset="": CPU infra CRI-O CPU infra . --insecure-registry="": () . "insecure" registries.conf . 1. CIDR . 2. HTTP HTTPS CA . 3. '--insecure-registry' . . (CA) '--insecure-registry' CA . --internal-repair: true CRI-O . --internal-wipe: CRI-O . false 'crio wipe' . . --irqbalance-config-file="": irqbalance CRI-O . (: "/etc/sysconfig/irqbalance") --irqbalance-config-restore-file="": CRI-O irqbalance . 'disable' . (: "/etc/sysconfig/orig_irq_banned_cpus") --listen="": CRI-O. (: "/run/crio/crio.sock") --log="": . --log-dir="": kubelet . (: "/var/log/crio/pods") --log-filter="": (regex) . 'request.*' gRPC . --log-format="": : 'text' 'json'. (: "text") --log-journald: systemd (journald) . --log-level, -l="": : trace debug info warn error fatal panic. (: "info") --log-size-max="": . >= 8192 conmon . . '--container-log-max-size' Kubelet . (: -1) --metrics-cert="": (secure metrics endpoint). --metrics-collectors="": . (: "image_pulls_layer_size", "containers_events_dropped_total", "containers_oom_total", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total", "containers_seccomp_notifier_count_total", "resources_stalled_at_stage", "containers_stopped_monitor_count", "default_runtime") --metrics-host="": . (: "127.0.0.1") --metrics-key="": . --metrics-port="": () . (: 9090) --metrics-socket="": . --min-injected-gomaxprocs="": GOMAXPROCS. Burstable CPU . Best-effort . 0 . (: 0) --minimum-mappable-gid="": GID UID 0 . (KEP-127) . (: -1) --minimum-mappable-uid="": UID UID 0 . (KEP-127) . (: -1) --namespaces-dir="": . manage-ns-lifecycle true . (: "/run") --no-pivot: true 'pivot_root' 'MS_MOVE' . --nri-disable-connections: NRI . --nri-enable-default-validator: NRI. --nri-listen="": NRI . (: "/run/nri/nri.sock") --nri-plugin-config-dir="": NRI. (: "/etc/nri/conf.d") --nri-plugin-dir="": NRI . (: "/opt/nri/plugins") --nri-plugin-registration-timeout="": NRI. (: 5s) --nri-plugin-request-timeout="": NRI. (: 2s) --nri-validator-reject-custom-seccomp-adjustment: seccomp NRI. --nri-validator-reject-namespace-adjustment: NRI. --nri-validator-reject-oci-hook-adjustment: OCI NRI. --nri-validator-reject-runtime-default-seccomp-adjustment: seccomp NRI. --nri-validator-reject-unconfined-seccomp-adjustment: seccomp (unconfined) NRI. --nri-validator-required-plugins="": NRI . --nri-validator-tolerate-missing-plugins-annotation="": NRI . --oci-artifact-mount-support: true CRI-O OCI (volume) . --pause-command="": pause pause. (: "/pause") --pause-image="": pause . (: "registry.k8s.io/pause:3.10.1") --pause-image-auth-file="": --pause-image. --pids-limit="": . . '--pod-pids-limit' Kubelet . (: -1) --pinned-images="": (garbage collection) . --pinns-path="": pinns . $PATH . --privileged-seccomp-profile="": seccomp . --profile: pprof 127.0.0.1:6060. --profile-cpu="": CPU pprof . --profile-mem="": pprof . --profile-port="": () pprof. (: 6060) --pull-progress-timeout="": . --pull-progress-timeout / 10 . 0 . (: 0s) --rdt-config-file="": RDT resctrl. --read-only: . tmpfs '/run' '/tmp' '/var/tmp' . --root, -r="": CRI-O. (: "/var/lib/containers/storage") --runroot="": CRI-O. (: "/run/containers/storage") --runtimes="": OCI 'runtime_name:runtime_path:runtime_root:runtime_type:privileged_without_host_devices:runtime_config_path:container_min_memory'. --seccomp-profile="": seccomp.json . seccomp . --selinux: selinux. SELinux . --separate-pull-cgroup="": [] cgroup . --shared-cpuset="": CPU (guaranteed) CPU . --short-name-mode="": . 'enforcing' 'disabled' . (: "enforcing") --signature-policy="": JSON . --signature-policy-dir="": . . (: "/etc/crio/policies") --stats-collection-period="": . 0 . : . (: 0) --storage-driver, -s="": OCI. --storage-opt="": OCI. --stream-address="": . (: "127.0.0.1") --stream-enable-tls: TLS . --stream-idle-timeout="": . --stream-port="": . '0' CRI-O . (: "0") --stream-tls-ca="": (CA) x509 . CRI-O . --stream-tls-cert="": x509 . CRI-O . --stream-tls-key="": . CRI-O . --timezone, --tz="": CRI-O. CRI-O . 'Local' . --tls-cipher-suites="": (cipher suites) TLS 1.2. --tls-min-version="": TLS (VersionTLS12 VersionTLS13). (: "VersionTLS12") --tracing-endpoint="": gRPC . (: "127.0.0.1:4317") --tracing-sampling-rate-per-million="": span OpenTelemetry. 1000000 . (: 0) --uid-mappings="": UID . (KEP-127) . --version, -v: --version-file="": CRI-O . crio wipe . (: "/run/crio/version") --version-file-persist="": CRI-O . crio wipe CRI-O . (COMMANDS) check CRI-O . . / (I/O) (CPU) . --quick . --repair --force CRI-O . --wipe . --force . --repair CRI-O . --age, -a="": (: "24h") --force, -f: --quick, -q: --repair, -r: --wipe, -w: (complete, completion) bash fish zsh. (config) CRI-O . --config . . --default: ( ). (man) (man page). (markdown, md) Markdown. --help, -h: (help, h) (status) --socket, -s="": (: "/run/crio/crio.sock") config, c CRI-O TOML. containers, container, cs, s . --id, -i="": info, i CRI-O cgroup . goroutines, g (goroutine stack). heap, hp (heap dump) . --file, -f="": . (VERSION) --json, -j: JSON --verbose, -v: ( golang) wipe CRI-O --force, -f: (help, h) (FILES) crio.conf (/etc/crio/crio.conf) cri-o crio(8) TOML . policy.json (/etc/containers/policy.json) ( ) . registries.conf (/etc/containers/registries.conf) . storage.conf (/etc/containers/storage.conf) . (ENVIRONMENT) . . KUBENSMNT: (bind-mounted) CRI-O . bindmount CRI-O . (SEE ALSO) crio.conf(5), crio.conf.d(5), oci-hooks(5), policy.json(5), registries.conf(5), storage.conf(5) crio(8)