--- reviewers: - vincepri - bart0sh title: CRI installation content_template: templates/concept weight: 100 --- {{% capture overview %}} Since v1.6.0, Kubernetes has enabled the use of CRI, Container Runtime Interface, by default. This page contains installation instruction for various runtimes. {{% /capture %}} {{% capture body %}} Please proceed with executing the following commands based on your OS as root. You may become the root user by executing `sudo -i` after SSH-ing to each host. {{< caution >}} A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. Please refer to this link for more information about this issue [cve-2019-5736 : runc vulnerability ] (https://access.redhat.com/security/cve/cve-2019-5736) {{< /caution >}} ## Docker On each of your machines, install Docker. Version 18.06.2 is recommended, but 1.11, 1.12, 1.13, 17.03 and 18.09 are known to work as well. Keep track of the latest verified Docker version in the Kubernetes release notes. Use the following commands to install Docker on your system: {{< tabs name="tab-cri-docker-installation" >}} {{< tab name="Ubuntu 16.04" codelang="bash" >}} # Install Docker CE ## Set up the repository: ### Update the apt package index apt-get update ### Install packages to allow apt to use a repository over HTTPS apt-get update && apt-get install apt-transport-https ca-certificates curl software-properties-common ### Add Docker’s official GPG key curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - ### Add docker apt repository. add-apt-repository \ "deb [arch=amd64] https://download.docker.com/linux/ubuntu \ $(lsb_release -cs) \ stable" ## Install docker ce. apt-get update && apt-get install docker-ce=18.06.2~ce~3-0~ubuntu # Setup daemon. cat > /etc/docker/daemon.json <}} {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}} # Install Docker CE ## Set up the repository ### Install required packages. yum install yum-utils device-mapper-persistent-data lvm2 ### Add docker repository. yum-config-manager \ --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo ## Install docker ce. yum update && yum install docker-ce-18.06.2.ce ## Create /etc/docker directory. mkdir /etc/docker # Setup daemon. cat > /etc/docker/daemon.json <}} {{< /tabs >}} Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/) for more information. ## CRI-O This section contains the necessary steps to install `CRI-O` as CRI runtime. Use the following commands to install CRI-O on your system: ### Prerequisites ```shell modprobe overlay modprobe br_netfilter # Setup required sysctl params, these persist across reboots. cat > /etc/sysctl.d/99-kubernetes-cri.conf <}} {{< tab name="Ubuntu 16.04" codelang="bash" >}} # Install prerequisites apt-get update apt-get install software-properties-common add-apt-repository ppa:projectatomic/ppa apt-get update # Install CRI-O apt-get install cri-o-1.11 {{< /tab >}} {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}} # Install prerequisites yum-config-manager --add-repo=https://cbs.centos.org/repos/paas7-crio-311-candidate/x86_64/os/ # Install CRI-O yum install --nogpgcheck cri-o {{< /tab >}} {{< /tabs >}} ### Start CRI-O ``` systemctl start crio ``` Refer to the [CRI-O installation guide](https://github.com/kubernetes-sigs/cri-o#getting-started) for more information. ## Containerd This section contains the necessary steps to use `containerd` as CRI runtime. Use the following commands to install Containerd on your system: ### Prerequisites ```shell modprobe overlay modprobe br_netfilter # Setup required sysctl params, these persist across reboots. cat > /etc/sysctl.d/99-kubernetes-cri.conf <}} {{< tab name="Ubuntu 16.04+" codelang="bash" >}} apt-get install -y libseccomp2 {{< /tab >}} {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}} yum install -y libseccomp {{< /tab >}} {{< /tabs >}} ### Install containerd [Containerd releases](https://github.com/containerd/containerd/releases) are published regularly, the values below are hardcoded to the latest version available at the time of writing. Please check for newer versions and hashes [here](https://storage.googleapis.com/cri-containerd-release). ```shell # Export required environment variables. export CONTAINERD_VERSION="1.1.2" export CONTAINERD_SHA256="d4ed54891e90a5d1a45e3e96464e2e8a4770cd380c21285ef5c9895c40549218" # Download containerd tar. wget https://storage.googleapis.com/cri-containerd-release/cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz # Check hash. echo "${CONTAINERD_SHA256} cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz" | sha256sum --check - # Unpack. tar --no-overwrite-dir -C / -xzf cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz # Start containerd. systemctl start containerd ``` ## Other CRI runtimes: frakti Refer to the [Frakti QuickStart guide](https://github.com/kubernetes/frakti#quickstart) for more information. {{% /capture %}}