From 86d41908a77f97bbc98cf3582a2f4ad3e8bc247e Mon Sep 17 00:00:00 2001 From: Sylvain Boily <4981802+djsly@users.noreply.github.com> Date: Tue, 14 Jul 2026 22:23:53 -0400 Subject: [PATCH 1/2] fix: align containerd v2 configs with 2.3 schema AB#38808465 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23f6b1fb-60fd-42c0-be94-af3644f84056 --- .../ubuntu/gb/containerd-nvidia.toml | 28 +++++++++---------- pkg/agent/baker.go | 16 +++++------ 2 files changed, 21 insertions(+), 23 deletions(-) diff --git a/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml b/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml index 88aa0fa0222..a3953609ad8 100644 --- a/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml +++ b/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml @@ -1,39 +1,37 @@ oom_score = -999 -version = 2 +version = 4 [metrics] address = "0.0.0.0:10257" -[plugins] +[plugins."io.containerd.cri.v1.images"] + sandbox = "mcr.microsoft.com/oss/kubernetes/pause:3.6" -[plugins."io.containerd.grpc.v1.cri"] - sandbox_image = "mcr.microsoft.com/oss/kubernetes/pause:3.6" - -[plugins."io.containerd.grpc.v1.cri".containerd] +[plugins."io.containerd.cri.v1.runtime".containerd] default_runtime_name = "nvidia" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.nvidia] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.nvidia.options] BinaryName = "/usr/bin/nvidia-container-runtime" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc.options] BinaryName = "/usr/bin/runc" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.untrusted] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.untrusted.options] BinaryName = "/usr/bin/runc" -[plugins."io.containerd.grpc.v1.cri".registry] +[plugins."io.containerd.cri.v1.images".registry] config_path = "/etc/containerd/certs.d" -[plugins."io.containerd.grpc.v1.cri".registry.headers] +[plugins."io.containerd.cri.v1.images".registry.headers] X-Meta-Source-Client = ["azure/aks"] diff --git a/pkg/agent/baker.go b/pkg/agent/baker.go index 092c6cb83fd..a17f3b2c397 100644 --- a/pkg/agent/baker.go +++ b/pkg/agent/baker.go @@ -1789,7 +1789,7 @@ root = "{{GetDataDir}}"{{- end}} ConfigPath = "/opt/confidential-containers/share/defaults/kata-containers/configuration-clh-snp.toml" {{- end}} ` - containerdV2ConfigTemplate ContainerdConfigTemplate = `version = 2 + containerdV2ConfigTemplate ContainerdConfigTemplate = `version = 4 oom_score = -999{{if HasDataDir }} root = "{{GetDataDir}}"{{- end}} [plugins."io.containerd.cri.v1.images"] @@ -1844,25 +1844,25 @@ root = "{{GetDataDir}}"{{- end}} address = "/run/overlaybd-snapshotter/overlaybd.sock" {{- end}} {{- if IsKata }} -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] +[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" privileged_without_host_devices = true - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata.options] ConfigPath = "/usr/share/defaults/kata-containers/configuration.toml" [proxy_plugins] [proxy_plugins.tardev] type = "snapshot" address = "/run/containerd/tardev-snapshotter.sock" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc] +[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata-cc] snapshotter = "tardev" runtime_type = "io.containerd.kata-cc.v2" privileged_without_host_devices = true pod_annotations = ["io.katacontainers.*"] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata-cc.options] ConfigPath = "/opt/confidential-containers/share/defaults/kata-containers/configuration-clh-snp.toml" {{- end}} ` - containerdV2NoGPUConfigTemplate ContainerdConfigTemplate = `version = 2 + containerdV2NoGPUConfigTemplate ContainerdConfigTemplate = `version = 4 oom_score = -999{{if HasDataDir }} root = "{{GetDataDir}}"{{- end}} [plugins."io.containerd.cri.v1.images"] @@ -1904,10 +1904,10 @@ root = "{{GetDataDir}}"{{- end}} address = "/run/overlaybd-snapshotter/overlaybd.sock" {{- end}} {{- if IsKata }} -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] +[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" privileged_without_host_devices = true - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata.options] ConfigPath = "/usr/share/defaults/kata-containers/configuration.toml" [proxy_plugins] [proxy_plugins.tardev] From 76a6b7afed8bb58c0e548a7986497ea3687fffaa Mon Sep 17 00:00:00 2001 From: Sylvain Boily <4981802+djsly@users.noreply.github.com> Date: Tue, 14 Jul 2026 22:41:28 -0400 Subject: [PATCH 2/2] fix: gate ANC containerd v4 config AB#38808465 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23f6b1fb-60fd-42c0-be94-af3644f84056 --- aks-node-controller/parser/helper.go | 5 ++ aks-node-controller/parser/helper_test.go | 77 +++++++++++++++++++ .../parser/templates/containerd.toml.gtpl | 52 ++++++++----- .../templates/containerd_no_GPU.toml.gtpl | 42 ++++++---- .../ubuntu/gb/containerd-nvidia.toml | 2 +- 5 files changed, 143 insertions(+), 35 deletions(-) diff --git a/aks-node-controller/parser/helper.go b/aks-node-controller/parser/helper.go index 3a79aac41b6..1491d63a392 100644 --- a/aks-node-controller/parser/helper.go +++ b/aks-node-controller/parser/helper.go @@ -73,11 +73,16 @@ func getFuncMapForContainerdConfigTemplate() template.FuncMap { "derefBool": deref[bool], "getEnsureNoDupePromiscuousBridge": getEnsureNoDupePromiscuousBridge, "isKubernetesVersionGe": helpers.IsKubernetesVersionGe, + "isContainerdVersionGe": isContainerdVersionGe, "getHasDataDir": getHasDataDir, "getEnableNvidia": getEnableNvidia, } } +func isContainerdVersionGe(containerdConfig *aksnodeconfigv1.ContainerdConfig, version string) bool { + return helpers.IsKubernetesVersionGe(containerdConfig.GetContainerdVersion(), version) +} + func getStringFromVMType(enum aksnodeconfigv1.VmType) string { switch enum { case aksnodeconfigv1.VmType_VM_TYPE_STANDARD: diff --git a/aks-node-controller/parser/helper_test.go b/aks-node-controller/parser/helper_test.go index 3a34f9b82df..1471cb58229 100644 --- a/aks-node-controller/parser/helper_test.go +++ b/aks-node-controller/parser/helper_test.go @@ -506,6 +506,83 @@ oom_score = -999 } } +func Test_containerdConfigFromAKSNodeConfig_Containerd23UsesV4(t *testing.T) { + aksnodeconfig := &aksnodeconfigv1.Configuration{ + NeedsCgroupv2: to.Ptr(true), + GpuConfig: &aksnodeconfigv1.GpuConfig{ + EnableNvidia: to.Ptr(true), + }, + ContainerdConfig: &aksnodeconfigv1.ContainerdConfig{ + ContainerdVersion: "2.3.2-ubuntu24.04u1", + }, + } + + got, err := containerdConfigFromAKSNodeConfig(aksnodeconfig, false) + if err != nil { + t.Fatalf("containerdConfigFromAKSNodeConfig() error = %v", err) + } + + for _, want := range []string{ + "version = 4", + `[plugins."io.containerd.cri.v1.images".pinned_images]`, + `sandbox = ""`, + `[plugins."io.containerd.cri.v1.runtime"]`, + "enable_cdi = true", + `[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.nvidia-container-runtime]`, + `[plugins."io.containerd.cri.v1.images".registry.headers]`, + } { + if !strings.Contains(got, want) { + t.Errorf("containerdConfigFromAKSNodeConfig() missing %q in:\n%s", want, got) + } + } + + for _, notWant := range []string{ + "version = 2", + "io.containerd.grpc.v1.cri", + "sandbox_image", + } { + if strings.Contains(got, notWant) { + t.Errorf("containerdConfigFromAKSNodeConfig() unexpectedly contains %q in:\n%s", notWant, got) + } + } +} + +func Test_containerdConfigFromAKSNodeConfig_BeforeContainerd23UsesV2(t *testing.T) { + aksnodeconfig := &aksnodeconfigv1.Configuration{ + NeedsCgroupv2: to.Ptr(true), + ContainerdConfig: &aksnodeconfigv1.ContainerdConfig{ + ContainerdVersion: "2.2.4-4.azl3", + }, + } + + got, err := containerdConfigFromAKSNodeConfig(aksnodeconfig, false) + if err != nil { + t.Fatalf("containerdConfigFromAKSNodeConfig() error = %v", err) + } + + for _, want := range []string{ + "version = 2", + `[plugins."io.containerd.grpc.v1.cri"]`, + `sandbox_image = ""`, + `[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]`, + `[plugins."io.containerd.grpc.v1.cri".registry.headers]`, + } { + if !strings.Contains(got, want) { + t.Errorf("containerdConfigFromAKSNodeConfig() missing %q in:\n%s", want, got) + } + } + + for _, notWant := range []string{ + "version = 4", + "io.containerd.cri.v1.images", + "io.containerd.cri.v1.runtime", + } { + if strings.Contains(got, notWant) { + t.Errorf("containerdConfigFromAKSNodeConfig() unexpectedly contains %q in:\n%s", notWant, got) + } + } +} + func Test_getKubenetTemplate(t *testing.T) { tests := []struct { name string diff --git a/aks-node-controller/parser/templates/containerd.toml.gtpl b/aks-node-controller/parser/templates/containerd.toml.gtpl index 6b9d7442fdb..fc773c9c01c 100644 --- a/aks-node-controller/parser/templates/containerd.toml.gtpl +++ b/aks-node-controller/parser/templates/containerd.toml.gtpl @@ -1,10 +1,24 @@ -version = 2 +{{- $isContainerdConfigV4 := isContainerdVersionGe .GetContainerdConfig "2.3.0" -}} +{{- $imagesPlugin := "io.containerd.grpc.v1.cri" -}} +{{- $runtimePlugin := "io.containerd.grpc.v1.cri" -}} +{{- if $isContainerdConfigV4 -}} +{{- $imagesPlugin = "io.containerd.cri.v1.images" -}} +{{- $runtimePlugin = "io.containerd.cri.v1.runtime" -}} +{{- end -}} +version = {{if $isContainerdConfigV4}}4{{else}}2{{end}} oom_score = -999{{if getHasDataDir .KubeletConfig}} root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} -[plugins."io.containerd.grpc.v1.cri"] +{{- if $isContainerdConfigV4 }} +[plugins."{{$imagesPlugin}}".pinned_images] + sandbox = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}" +[plugins."{{$runtimePlugin}}"] + enable_cdi = true +{{- else }} +[plugins."{{$imagesPlugin}}"] sandbox_image = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}" enable_cdi = true - [plugins."io.containerd.grpc.v1.cri".containerd] +{{- end }} + [plugins."{{$runtimePlugin}}".containerd] {{- if .GetIsKata }} disable_snapshot_annotations = false {{- end}} @@ -14,42 +28,42 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} {{- end}} {{- if getEnableNvidia . }} default_runtime_name = "nvidia-container-runtime" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia-container-runtime] + [plugins."{{$runtimePlugin}}".containerd.runtimes.nvidia-container-runtime] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia-container-runtime.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.nvidia-container-runtime.options] BinaryName = "/usr/bin/nvidia-container-runtime" {{- if .GetNeedsCgroupv2 }} SystemdCgroup = true {{- end}} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted.options] BinaryName = "/usr/bin/nvidia-container-runtime" {{- else}} default_runtime_name = "runc" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + [plugins."{{$runtimePlugin}}".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.runc.options] BinaryName = "/usr/bin/runc" {{- if .GetNeedsCgroupv2 }} SystemdCgroup = true {{- end}} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted.options] BinaryName = "/usr/bin/runc" {{- end}} {{- if getEnsureNoDupePromiscuousBridge .GetNetworkConfig }} - [plugins."io.containerd.grpc.v1.cri".cni] + [plugins."{{$runtimePlugin}}".cni] bin_dir = "/opt/cni/bin" conf_dir = "/etc/cni/net.d" conf_template = "/etc/containerd/kubenet_template.conf" {{- end}} {{- if isKubernetesVersionGe .GetKubernetesVersion "1.22.0"}} - [plugins."io.containerd.grpc.v1.cri".registry] + [plugins."{{$imagesPlugin}}".registry] config_path = "/etc/containerd/certs.d" {{- end}} - [plugins."io.containerd.grpc.v1.cri".registry.headers] + [plugins."{{$imagesPlugin}}".registry.headers] X-Meta-Source-Client = ["azure/aks"] [metrics] address = "0.0.0.0:10257" @@ -60,11 +74,11 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} address = "/run/overlaybd-snapshotter/overlaybd.sock" {{- end}} {{- if .GetIsKata }} -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] +[plugins."{{$runtimePlugin}}".containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katacli] +[plugins."{{$runtimePlugin}}".containerd.runtimes.katacli] runtime_type = "io.containerd.runc.v1" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katacli.options] +[plugins."{{$runtimePlugin}}".containerd.runtimes.katacli.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" @@ -78,11 +92,11 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} [proxy_plugins.tardev] type = "snapshot" address = "/run/containerd/tardev-snapshotter.sock" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc] +[plugins."{{$runtimePlugin}}".containerd.runtimes.kata-cc] snapshotter = "tardev" runtime_type = "io.containerd.kata-cc.v2" privileged_without_host_devices = true pod_annotations = ["io.katacontainers.*"] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.kata-cc.options] ConfigPath = "/opt/confidential-containers/share/defaults/kata-containers/configuration-clh-snp.toml" {{- end}} diff --git a/aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl b/aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl index 2eb27cab54c..b8e1e404ea2 100644 --- a/aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl +++ b/aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl @@ -1,9 +1,21 @@ -version = 2 +{{- $isContainerdConfigV4 := isContainerdVersionGe .GetContainerdConfig "2.3.0" -}} +{{- $imagesPlugin := "io.containerd.grpc.v1.cri" -}} +{{- $runtimePlugin := "io.containerd.grpc.v1.cri" -}} +{{- if $isContainerdConfigV4 -}} +{{- $imagesPlugin = "io.containerd.cri.v1.images" -}} +{{- $runtimePlugin = "io.containerd.cri.v1.runtime" -}} +{{- end -}} +version = {{if $isContainerdConfigV4}}4{{else}}2{{end}} oom_score = -999{{if getHasDataDir .KubeletConfig}} root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} -[plugins."io.containerd.grpc.v1.cri"] +{{- if $isContainerdConfigV4 }} +[plugins."{{$imagesPlugin}}".pinned_images] + sandbox = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}" +{{- else }} +[plugins."{{$imagesPlugin}}"] sandbox_image = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}" - [plugins."io.containerd.grpc.v1.cri".containerd] +{{- end }} + [plugins."{{$runtimePlugin}}".containerd] {{- if .GetIsKata }} disable_snapshot_annotations = false {{- end}} @@ -12,28 +24,28 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} disable_snapshot_annotations = false {{- end}} default_runtime_name = "runc" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + [plugins."{{$runtimePlugin}}".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.runc.options] BinaryName = "/usr/bin/runc" {{- if .GetNeedsCgroupv2 }} SystemdCgroup = true {{- end}} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted] runtime_type = "io.containerd.runc.v2" - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.untrusted.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.untrusted.options] BinaryName = "/usr/bin/runc" {{- if getEnsureNoDupePromiscuousBridge .GetNetworkConfig }} - [plugins."io.containerd.grpc.v1.cri".cni] + [plugins."{{$runtimePlugin}}".cni] bin_dir = "/opt/cni/bin" conf_dir = "/etc/cni/net.d" conf_template = "/etc/containerd/kubenet_template.conf" {{- end}} {{- if isKubernetesVersionGe .GetKubernetesVersion "1.22.0"}} - [plugins."io.containerd.grpc.v1.cri".registry] + [plugins."{{$imagesPlugin}}".registry] config_path = "/etc/containerd/certs.d" {{- end}} - [plugins."io.containerd.grpc.v1.cri".registry.headers] + [plugins."{{$imagesPlugin}}".registry.headers] X-Meta-Source-Client = ["azure/aks"] [metrics] address = "0.0.0.0:10257" @@ -44,11 +56,11 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} address = "/run/overlaybd-snapshotter/overlaybd.sock" {{- end}} {{- if .GetIsKata }} -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] +[plugins."{{$runtimePlugin}}".containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katacli] +[plugins."{{$runtimePlugin}}".containerd.runtimes.katacli] runtime_type = "io.containerd.runc.v1" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katacli.options] +[plugins."{{$runtimePlugin}}".containerd.runtimes.katacli.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" @@ -62,11 +74,11 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}} [proxy_plugins.tardev] type = "snapshot" address = "/run/containerd/tardev-snapshotter.sock" -[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc] +[plugins."{{$runtimePlugin}}".containerd.runtimes.kata-cc] snapshotter = "tardev" runtime_type = "io.containerd.kata-cc.v2" privileged_without_host_devices = true pod_annotations = ["io.katacontainers.*"] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-cc.options] + [plugins."{{$runtimePlugin}}".containerd.runtimes.kata-cc.options] ConfigPath = "/opt/confidential-containers/share/defaults/kata-containers/configuration-clh-snp.toml" {{- end}} diff --git a/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml b/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml index a3953609ad8..b7e230162b7 100644 --- a/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml +++ b/parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml @@ -4,7 +4,7 @@ version = 4 [metrics] address = "0.0.0.0:10257" -[plugins."io.containerd.cri.v1.images"] +[plugins."io.containerd.cri.v1.images".pinned_images] sandbox = "mcr.microsoft.com/oss/kubernetes/pause:3.6" [plugins."io.containerd.cri.v1.runtime".containerd]