Kubernetes talks to a CRI-compatible runtime rather than Docker Engine. This lab installs containerd, enables required kernel settings, generates a clean configuration, enables systemd cgroups, and validates the CRI endpoint.
1. Prepare and execute
Confirm the active kubeconfig context and namespace before applying changes. Save commands and manifests in version control without credentials.
sudo modprobe overlay
sudo modprobe br_netfilter
cat <<'EOF' | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
cat <<'EOF' | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
sudo sysctl --system
sudo apt update
sudo apt install -y containerd
2. Declarative configuration
Save the following example in a clearly named YAML file, review it, then use server-side dry-run when the API is available.
# Generate /etc/containerd/config.toml, then set:
# SystemdCgroup = true
# Verify the sandbox image matches the Kubernetes release guidance.
3. Verify the result
A successful command is not enough. Inspect resource state, conditions, events, endpoints, logs, and an end-to-end request where applicable.
sudo install -d /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml >/dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo containerd config dump >/dev/null
sudo systemctl enable --now containerd
systemctl is-active containerd
sudo ctr version
sudo crictl --runtime-endpoint unix:///run/containerd/containerd.sock info
4. Troubleshooting
If crictl reports an endpoint error, verify /run/containerd/containerd.sock and the containerd journal. If kubelet reports cgroup conflicts, confirm both kubelet and containerd use systemd cgroups.
5. Rollback and cleanup
Review the exact target before deleting resources, especially namespaces, claims, Secrets, and cluster-wide add-ons.
sudo cp /etc/containerd/config.toml /etc/containerd/config.toml.bad
sudo apt reinstall -y containerd
sudo systemctl restart containerd
Production checklist
- The active context, namespace, and target version were verified.
- Manifests passed client or server-side validation.
- Resource conditions and recent events show no unresolved error.
- Access, network exposure, resource limits, persistence, and rollback were reviewed.
- Commands and expected output were recorded for the operating team.
References: topic documentation and Kubernetes documentation.
