Install cri-dockerd and Set Kubernetes Kernel Parameters

Original Prepium guide · Written for Kubernetes v1.35 and checked against the official documentation on 6 October 2026. Use a disposable practice cluster. Everything here changes a node's services and kernel settings, so use a throwaway VM, and run the read-only checks before installing or enabling anything.

The Container Runtime Interface, cri-dockerd, and the kernel settings a node needs

The kubelet does not start containers itself. It speaks the Container Runtime Interface (CRI), a gRPC API, to a runtime listening on a Unix socket. containerd and CRI-O implement CRI natively; Docker Engine does not. Until v1.24 the kubelet carried a built-in Docker adapter called dockershim. It was removed in v1.24, and cri-dockerd is the standalone replacement: a shim that exposes CRI on one side and drives Docker Engine on the other.

kubelet ──CRI (gRPC)──→ unix:///var/run/cri-dockerd.sock ──→ cri-dockerd ──→ Docker Engine
kubelet ──CRI (gRPC)──→ unix:///var/run/containerd/containerd.sock ──→ containerd   (no shim)

1. See what the node already has (read-only)

ls -l /var/run/*.sock /var/run/containerd/ 2>/dev/null
systemctl status docker cri-docker.socket cri-docker.service --no-pager
sysctl net.ipv4.ip_forward
lsmod | head

Docker Engine ships with containerd, so a Docker node often exposes two CRI-capable sockets. kubeadm scans a list of known endpoints, and if it finds more than one it stops and asks you to choose with --cri-socket (or nodeRegistration.criSocket in a config file). The kubeadm docs list the Linux socket for Docker Engine via cri-dockerd as unix:///var/run/cri-dockerd.sock.

2. Understand the two systemd units

The project's packaging installs a cri-docker.socket unit, which listens on %t/cri-dockerd.sock (%t is the runtime directory, /run for system units), and a cri-docker.service unit that Requires= the socket and starts after docker.service. Installing a package only puts files on disk. Enabling the units makes them start at boot, and starting them creates the socket now, which is why a correct check looks at both:

systemctl is-enabled cri-docker.service
systemctl is-active cri-docker.service
crictl --runtime-endpoint unix:///var/run/cri-dockerd.sock info

crictl takes the endpoint from --runtime-endpoint, the CONTAINER_RUNTIME_ENDPOINT variable, or /etc/crictl.yaml. Without one it probes a list of known sockets, which is slower and may land on containerd instead of cri-dockerd.

3. Persist kernel parameters the right way

For v1.35 the kubernetes.io prerequisites list exactly one sysctl: net.ipv4.ip_forward = 1, because Linux does not route IPv4 between interfaces by default. The same page says your network plugin (or your environment) may require further parameters and kernel modules, so read its docs, or the task, for the full list. Our own example file:

cat <<'EOF' > /etc/sysctl.d/90-practice-node.conf
net.ipv4.ip_forward = 1
EOF
sysctl --system
sysctl net.ipv4.ip_forward

sysctl --system reads /etc/sysctl.d/*.conf along with the other system directories, so a file there survives reboots, whereas sysctl -w changes only the running kernel. If your network plugin also needs kernel modules, load them with modprobe and list them in /etc/modules-load.d/ so they come back after a reboot.

Common mistakes

• Assuming the package install also enabled and started the units: check is-enabled and is-active, because without a listening socket kubeadm and crictl have nothing to connect to.
• Forgetting Docker Engine itself: cri-dockerd is only an adapter, so with docker.service stopped there is nothing behind the CRI socket to run containers.
• Writing settings with sysctl -w only: correct now, gone after a reboot.
• A typo in a key name inside the .conf file: sysctl --system reports an error for that line and the value is never set. Re-read each key with sysctl <key>.

Cleanup: on the practice VM, remove /etc/sysctl.d/90-practice-node.conf and rerun sysctl --system (values already applied stay until reboot or until you set them back). References: Container Runtimes, Installing kubeadm, Debugging Kubernetes nodes with crictl, cri-dockerd. Next, try control-plane troubleshooting or Docker daemon hardening.