> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Containerd

> Customize Containerd Settings

Use named [`CRICustomizationConfig`](../../reference/configuration/cri/cricustomizationconfig) documents to customize the CRI containerd configuration.
Talos merges each document's TOML fragment with the physical CRI configuration parts in lexicographical order by name.

Applying, updating, or removing a `CRICustomizationConfig` regenerates the CRI configuration and restarts CRI automatically.
A Talos node reboot is not required.

The deprecated `/etc/cri/conf.d/20-customization.part` machine file remains supported during the deprecation period.
Talos includes this legacy fragment under the reserved name `customization`, which a `CRICustomizationConfig` document cannot use.

## Examples

The following examples show common CRI containerd customizations.

### Exposing metrics

Patch the machine config by adding the following:

```yaml theme={null}
apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"
```

After Talos applies the document and restarts CRI, metrics are available:

```bash theme={null}
curl ${IP}:11234/v1/metrics
# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive
# TYPE container_blkio_io_service_bytes_recursive_bytes gauge
container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0
container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0
...
...
```

### Pause image

This change is often required for air-gapped environments, as `containerd` CRI plugin has a reference to the `pause` image which is used
to create pods, and it can't be controlled with Kubernetes pod definitions.

```yaml theme={null}
apiVersion: v1alpha1
kind: CRICustomizationConfig
name: pause-image
content: |
  [plugins]
    [plugins."io.containerd.cri.v1.images".pinned_images]
      sandbox = "registry.k8s.io/pause:3.8"
```

Now the `pause` image is set to `registry.k8s.io/pause:3.8`:

```bash theme={null}
talosctl containers --namespace=cri
NODE         NAMESPACE   ID                                                              IMAGE                                                      PID    STATUS
172.20.0.5   k8s.io      kube-system/kube-flannel-6hfck                                  registry.k8s.io/pause:3.8                                  1773   SANDBOX_READY
172.20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:install-cni:bc39fec3cbac      ghcr.io/siderolabs/install-cni:v1.3.0-alpha.0-2-gb155fa0   0      CONTAINER_EXITED
172.20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:install-config:5c3989353b98   ghcr.io/siderolabs/flannel:v0.20.1                         0      CONTAINER_EXITED
172.20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:kube-flannel:116c67b50da8     ghcr.io/siderolabs/flannel:v0.20.1                         2092   CONTAINER_RUNNING
172.20.0.5   k8s.io      kube-system/kube-proxy-xp7jq                                    registry.k8s.io/pause:3.8                                  1780   SANDBOX_READY
172.20.0.5   k8s.io      └─ kube-system/kube-proxy-xp7jq:kube-proxy:84fc77c59e17         registry.k8s.io/kube-proxy:v1.26.0-alpha.3                 1843   CONTAINER_RUNNING
```

### Disabling NRI plugins

Talos 1.14 enables [NRI](https://github.com/containerd/containerd/blob/main/docs/NRI.md) (Node Resource Interface) for the CRI containerd instance by default.
NRI plugins can be deployed without a machine configuration patch, for example plugins from [the NRI plugins repository](https://containers.github.io/nri-plugins/stable/docs/index.html).

To restore the previous behavior and disable NRI, add the following configuration document:

```yaml theme={null}
apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.