Answers: <p>I also catch this issue, steps as bellow can fix it.</p>
  <ol>
  <li>docker pull docker/desktop-kubernetes-pause:3.8</li>
  <li>docker images
  you'll see result like bellow:</li>
  </ol>
  <blockquote>
  <p>docker/desktop-kubernetes-pause 3.8 4873874c08ef 19 months ago 711kB</p>
  </blockquote>
  <p>// tag pause to registry.k8s.io/pause:3.8<br />
  3. docker tag 4873874c08ef registry.k8s.io/pause:3.8</p>
  <p>// import pause to containerd<br />
  4. ctr -n k8s.io images import pause.tar<br />
  5. sudo ctr -n k8s.io images import pause.tar</p>
  <p>Then restart kubelet, after kubelet daemon is active and healthy, you can reset k8s cluster, and reinstall k8s again.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-02T12:13:12.970Z
Answers: I have already tried like this, but this image will reset in the furture and I have to do this steps again.
Answers: Dolphin
Answers: CC BY-SA 4.0
Answers: 2024-02-03T16:28:19.220Z
Answers: Maybe add proxy settings or set a proper repository for containerd can help.
Answers: stevenzearo
Answers: CC BY-SA 4.0
Answers: 2024-02-01T08:58:00.193Z
Answers: 2024-02-01T08:58:00.193Z
Answers: stevenzearo
Answers: <p>I found another way to solve this issue by change the containerd sandbox image:</p>
  <pre><code>version = 2
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;]
    #sandbox_image = &quot;k8s.m.daocloud.io/pause:3.6&quot;
    sandbox_image = &quot;registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6&quot;
  </code></pre>
  <p>replace the <code>sandbox_image</code> to any mirror address you can access.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-19T12:21:52.890Z
Answers: 2024-02-19T12:21:52.890Z
Answers: Dolphin
Body: <p>Today I found some events in kubernetes(<code>v1.28.3</code>) cluster, this error event look like this:</p>
  <pre><code>(combined from similar events): Failed to create pod sandbox: rpc error: code = DeadlineExceeded desc = failed to get sandbox image &quot;registry.k8s.io/pause:3.6&quot;: failed to pull image &quot;registry.k8s.io/pause:3.6&quot;: failed to pull and unpack image &quot;registry.k8s.io/pause:3.6&quot;: failed to resolve reference &quot;registry.k8s.io/pause:3.6&quot;: failed to do request: Head &quot;https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.6&quot;: dial tcp 74.125.204.82:443: i/o timeout
  </code></pre>
  <p>I know it may be a network issue when download the <code>registry.k8s.io/pause:3.6</code> image, but I could not found the image <code>registry.k8s.io/pause:3.6</code> config in the deamon set, this is the yaml define:</p>
  <pre><code>apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: calico-node
    namespace: calico-system
    annotations:
      deprecated.daemonset.template.generation: '1'
  status:
    currentNumberScheduled: 2
    numberMisscheduled: 0
    desiredNumberScheduled: 2
    numberReady: 1
    observedGeneration: 1
    updatedNumberScheduled: 2
    numberAvailable: 1
    numberUnavailable: 1
  spec:
    selector:
      matchLabels:
        k8s-app: calico-node
    template:
      metadata:
        creationTimestamp: null
        labels:
          app.kubernetes.io/name: calico-node
          k8s-app: calico-node
        annotations:
          hash.operator.tigera.io/cni-config: 9f0a12e03c58671de56ed3876cb88f1c43cef5dc
          hash.operator.tigera.io/system: bb4746872201725da2dea19756c475aa67d9c1e9
          hash.operator.tigera.io/tigera-ca-private: 8766b9b7cef0ba4722da2eb519044c7c3b68df33
      spec:
        volumes:
          - name: lib-modules
            hostPath:
              path: /lib/modules
              type: ''
          - name: xtables-lock
            hostPath:
              path: /run/xtables.lock
              type: FileOrCreate
          - name: policysync
            hostPath:
              path: /var/run/nodeagent
              type: DirectoryOrCreate
          - name: tigera-ca-bundle
            configMap:
              name: tigera-ca-bundle
              defaultMode: 420
          - name: node-certs
            secret:
              secretName: node-certs
              defaultMode: 420
          - name: var-run-calico
            hostPath:
              path: /var/run/calico
              type: ''
          - name: var-lib-calico
            hostPath:
              path: /var/lib/calico
              type: ''
          - name: cni-bin-dir
            hostPath:
              path: /opt/cni/bin
              type: ''
          - name: cni-net-dir
            hostPath:
              path: /etc/cni/net.d
              type: ''
          - name: cni-log-dir
            hostPath:
              path: /var/log/calico/cni
              type: ''
          - name: flexvol-driver-host
            hostPath:
              path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
              type: DirectoryOrCreate
        initContainers:
          - name: flexvol-driver
            image: docker.io/calico/pod2daemon-flexvol:v3.26.1
            resources: {}
            volumeMounts:
              - name: flexvol-driver-host
                mountPath: /host/driver
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
          - name: install-cni
            image: docker.io/calico/cni:v3.26.1
            command:
              - /opt/cni/bin/install
            env:
              - name: CNI_CONF_NAME
                value: 10-calico.conflist
              - name: SLEEP
                value: 'false'
              - name: CNI_NET_DIR
                value: /etc/cni/net.d
              - name: CNI_NETWORK_CONFIG
                valueFrom:
                  configMapKeyRef:
                    name: cni-config
                    key: config
              - name: KUBERNETES_SERVICE_HOST
                value: 10.96.0.1
              - name: KUBERNETES_SERVICE_PORT
                value: '443'
            resources: {}
            volumeMounts:
              - name: cni-bin-dir
                mountPath: /host/opt/cni/bin
              - name: cni-net-dir
                mountPath: /host/etc/cni/net.d
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
        containers:
          - name: calico-node
            image: docker.io/calico/node:v3.26.1
            env:
              - name: DATASTORE_TYPE
                value: kubernetes
              - name: WAIT_FOR_DATASTORE
                value: 'true'
              - name: CLUSTER_TYPE
                value: k8s,operator,bgp
              - name: CALICO_DISABLE_FILE_LOGGING
                value: 'false'
              - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
                value: ACCEPT
              - name: FELIX_HEALTHENABLED
                value: 'true'
              - name: FELIX_HEALTHPORT
                value: '9099'
              - name: NODENAME
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: spec.nodeName
              - name: NAMESPACE
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
              - name: FELIX_TYPHAK8SNAMESPACE
                value: calico-system
              - name: FELIX_TYPHAK8SSERVICENAME
                value: calico-typha
              - name: FELIX_TYPHACAFILE
                value: /etc/pki/tls/certs/tigera-ca-bundle.crt
              - name: FELIX_TYPHACERTFILE
                value: /node-certs/tls.crt
              - name: FELIX_TYPHAKEYFILE
                value: /node-certs/tls.key
              - name: FIPS_MODE_ENABLED
                value: 'false'
              - name: FELIX_TYPHACN
                value: typha-server
              - name: CALICO_MANAGE_CNI
                value: 'true'
              - name: CALICO_IPV4POOL_CIDR
                value: 10.96.0.0/12
              - name: CALICO_IPV4POOL_VXLAN
                value: CrossSubnet
              - name: CALICO_IPV4POOL_BLOCK_SIZE
                value: '26'
              - name: CALICO_IPV4POOL_NODE_SELECTOR
                value: all()
              - name: CALICO_IPV4POOL_DISABLE_BGP_EXPORT
                value: 'false'
              - name: CALICO_NETWORKING_BACKEND
                value: bird
              - name: IP
                value: autodetect
              - name: IP_AUTODETECTION_METHOD
                value: first-found
              - name: IP6
                value: none
              - name: FELIX_IPV6SUPPORT
                value: 'false'
              - name: KUBERNETES_SERVICE_HOST
                value: 10.96.0.1
              - name: KUBERNETES_SERVICE_PORT
                value: '443'
            resources: {}
            volumeMounts:
              - name: tigera-ca-bundle
                readOnly: true
                mountPath: /etc/pki/tls/certs
              - name: tigera-ca-bundle
                readOnly: true
                mountPath: /etc/pki/tls/cert.pem
                subPath: ca-bundle.crt
              - name: lib-modules
                readOnly: true
                mountPath: /lib/modules
              - name: xtables-lock
                mountPath: /run/xtables.lock
              - name: policysync
                mountPath: /var/run/nodeagent
              - name: node-certs
                readOnly: true
                mountPath: /node-certs
              - name: var-run-calico
                mountPath: /var/run/calico
              - name: var-lib-calico
                mountPath: /var/lib/calico
              - name: cni-log-dir
                mountPath: /var/log/calico/cni
              - name: cni-net-dir
                mountPath: /host/etc/cni/net.d
            livenessProbe:
              httpGet:
                path: /liveness
                port: 9099
                host: localhost
                scheme: HTTP
              timeoutSeconds: 10
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            readinessProbe:
              exec:
                command:
                  - /bin/calico-node
                  - '-bird-ready'
                  - '-felix-ready'
              timeoutSeconds: 5
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            lifecycle:
              preStop:
                exec:
                  command:
                    - /bin/calico-node
                    - '-shutdown'
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
        restartPolicy: Always
        terminationGracePeriodSeconds: 5
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: calico-node
        serviceAccount: calico-node
        hostNetwork: true
        securityContext: {}
        schedulerName: default-scheduler
        tolerations:
          - key: CriticalAddonsOnly
            operator: Exists
          - operator: Exists
            effect: NoSchedule
          - operator: Exists
            effect: NoExecute
        priorityClassName: system-node-critical
    updateStrategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 1
        maxSurge: 0
    revisionHistoryLimit: 10
  </code></pre>
  <p>where is the pause image configuration? what should I do to find out? I have tried to change the kubelet config and add mirror address like this:</p>
  <pre><code>[root@k8sslave01 kubelet]# systemctl status kubelet --full
  ● kubelet.service - kubelet: The Kubernetes Node Agent
     Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/kubelet.service.d
             └─10-kubeadm.conf
     Active: active (running) since Mon 2024-02-19 12:26:30 CST; 33min ago
       Docs: https://kubernetes.io/docs/
   Main PID: 30876 (kubelet)
      Tasks: 11
     Memory: 84.6M
     CGroup: /system.slice/kubelet.service
             └─30876 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
  </code></pre>
  <p>the <code>registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6</code> is the new address. It seems did not work. I have already test the container is accessable:</p>
  <pre><code>[root@k8sslave01 kubelet]# crictl pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
  Image is up to date for sha256:6270bb605e12e581514ada5fd5b3216f727db55dc87d5889c790e4c760683fee
  </code></pre>
  
Tags: <kubernetes>
Title: Failed to create pod sandbox: rpc error: code = DeadlineExceeded desc = failed to get sandbox image "registry.k8s.io/pause:3.6
UserDisplayName: Dolphin
ThreadText: # Failed to create pod sandbox: rpc error: code = DeadlineExceeded desc = failed to get sandbox image "registry.k8s.io/pause:3.6
  
  (Asked by: username_0 on 2023-11-11)
  
  Today I found some events in kubernetes(`v1.28.3`) cluster, this error event look like this:
  
  ```
  (combined from similar events): Failed to create pod sandbox: rpc error: code = DeadlineExceeded desc = failed to get sandbox image "registry.k8s.io/pause:3.6": failed to pull image "registry.k8s.io/pause:3.6": failed to pull and unpack image "registry.k8s.io/pause:3.6": failed to resolve reference "registry.k8s.io/pause:3.6": failed to do request: Head "https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.6": dial tcp 74.125.204.82:443: i/o timeout
  
  ```
  
  I know it may be a network issue when download the `registry.k8s.io/pause:3.6` image, but I could not found the image `registry.k8s.io/pause:3.6` config in the deamon set, this is the yaml define:
  
  ```
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: calico-node
    namespace: calico-system
    annotations:
      deprecated.daemonset.template.generation: '1'
  status:
    currentNumberScheduled: 2
    numberMisscheduled: 0
    desiredNumberScheduled: 2
    numberReady: 1
    observedGeneration: 1
    updatedNumberScheduled: 2
    numberAvailable: 1
    numberUnavailable: 1
  spec:
    selector:
      matchLabels:
        k8s-app: calico-node
    template:
      metadata:
        creationTimestamp: null
        labels:
          app.kubernetes.io/name: calico-node
          k8s-app: calico-node
        annotations:
          hash.operator.tigera.io/cni-config: 9f0a12e03c58671de56ed3876cb88f1c43cef5dc
          hash.operator.tigera.io/system: bb4746872201725da2dea19756c475aa67d9c1e9
          hash.operator.tigera.io/tigera-ca-private: 8766b9b7cef0ba4722da2eb519044c7c3b68df33
      spec:
        volumes:
          - name: lib-modules
            hostPath:
              path: /lib/modules
              type: ''
          - name: xtables-lock
            hostPath:
              path: /run/xtables.lock
              type: FileOrCreate
          - name: policysync
            hostPath:
              path: /var/run/nodeagent
              type: DirectoryOrCreate
          - name: tigera-ca-bundle
            configMap:
              name: tigera-ca-bundle
              defaultMode: 420
          - name: node-certs
            secret:
              secretName: node-certs
              defaultMode: 420
          - name: var-run-calico
            hostPath:
              path: /var/run/calico
              type: ''
          - name: var-lib-calico
            hostPath:
              path: /var/lib/calico
              type: ''
          - name: cni-bin-dir
            hostPath:
              path: /opt/cni/bin
              type: ''
          - name: cni-net-dir
            hostPath:
              path: /etc/cni/net.d
              type: ''
          - name: cni-log-dir
            hostPath:
              path: /var/log/calico/cni
              type: ''
          - name: flexvol-driver-host
            hostPath:
              path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
              type: DirectoryOrCreate
        initContainers:
          - name: flexvol-driver
            image: docker.io/calico/pod2daemon-flexvol:v3.26.1
            resources: {}
            volumeMounts:
              - name: flexvol-driver-host
                mountPath: /host/driver
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
          - name: install-cni
            image: docker.io/calico/cni:v3.26.1
            command:
              - /opt/cni/bin/install
            env:
              - name: CNI_CONF_NAME
                value: 10-calico.conflist
              - name: SLEEP
                value: 'false'
              - name: CNI_NET_DIR
                value: /etc/cni/net.d
              - name: CNI_NETWORK_CONFIG
                valueFrom:
                  configMapKeyRef:
                    name: cni-config
                    key: config
              - name: KUBERNETES_SERVICE_HOST
                value: 10.96.0.1
              - name: KUBERNETES_SERVICE_PORT
                value: '443'
            resources: {}
            volumeMounts:
              - name: cni-bin-dir
                mountPath: /host/opt/cni/bin
              - name: cni-net-dir
                mountPath: /host/etc/cni/net.d
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
        containers:
          - name: calico-node
            image: docker.io/calico/node:v3.26.1
            env:
              - name: DATASTORE_TYPE
                value: kubernetes
              - name: WAIT_FOR_DATASTORE
                value: 'true'
              - name: CLUSTER_TYPE
                value: k8s,operator,bgp
              - name: CALICO_DISABLE_FILE_LOGGING
                value: 'false'
              - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
                value: ACCEPT
              - name: FELIX_HEALTHENABLED
                value: 'true'
              - name: FELIX_HEALTHPORT
                value: '9099'
              - name: NODENAME
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: spec.nodeName
              - name: NAMESPACE
                valueFrom:
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
              - name: FELIX_TYPHAK8SNAMESPACE
                value: calico-system
              - name: FELIX_TYPHAK8SSERVICENAME
                value: calico-typha
              - name: FELIX_TYPHACAFILE
                value: /etc/pki/tls/certs/tigera-ca-bundle.crt
              - name: FELIX_TYPHACERTFILE
                value: /node-certs/tls.crt
              - name: FELIX_TYPHAKEYFILE
                value: /node-certs/tls.key
              - name: FIPS_MODE_ENABLED
                value: 'false'
              - name: FELIX_TYPHACN
                value: typha-server
              - name: CALICO_MANAGE_CNI
                value: 'true'
              - name: CALICO_IPV4POOL_CIDR
                value: 10.96.0.0/12
              - name: CALICO_IPV4POOL_VXLAN
                value: CrossSubnet
              - name: CALICO_IPV4POOL_BLOCK_SIZE
                value: '26'
              - name: CALICO_IPV4POOL_NODE_SELECTOR
                value: all()
              - name: CALICO_IPV4POOL_DISABLE_BGP_EXPORT
                value: 'false'
              - name: CALICO_NETWORKING_BACKEND
                value: bird
              - name: IP
                value: autodetect
              - name: IP_AUTODETECTION_METHOD
                value: first-found
              - name: IP6
                value: none
              - name: FELIX_IPV6SUPPORT
                value: 'false'
              - name: KUBERNETES_SERVICE_HOST
                value: 10.96.0.1
              - name: KUBERNETES_SERVICE_PORT
                value: '443'
            resources: {}
            volumeMounts:
              - name: tigera-ca-bundle
                readOnly: true
                mountPath: /etc/pki/tls/certs
              - name: tigera-ca-bundle
                readOnly: true
                mountPath: /etc/pki/tls/cert.pem
                subPath: ca-bundle.crt
              - name: lib-modules
                readOnly: true
                mountPath: /lib/modules
              - name: xtables-lock
                mountPath: /run/xtables.lock
              - name: policysync
                mountPath: /var/run/nodeagent
              - name: node-certs
                readOnly: true
                mountPath: /node-certs
              - name: var-run-calico
                mountPath: /var/run/calico
              - name: var-lib-calico
                mountPath: /var/lib/calico
              - name: cni-log-dir
                mountPath: /var/log/calico/cni
              - name: cni-net-dir
                mountPath: /host/etc/cni/net.d
            livenessProbe:
              httpGet:
                path: /liveness
                port: 9099
                host: localhost
                scheme: HTTP
              timeoutSeconds: 10
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            readinessProbe:
              exec:
                command:
                  - /bin/calico-node
                  - '-bird-ready'
                  - '-felix-ready'
              timeoutSeconds: 5
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            lifecycle:
              preStop:
                exec:
                  command:
                    - /bin/calico-node
                    - '-shutdown'
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
            imagePullPolicy: IfNotPresent
            securityContext:
              capabilities:
                drop:
                  - ALL
              privileged: true
              runAsUser: 0
              runAsGroup: 0
              runAsNonRoot: false
              allowPrivilegeEscalation: true
              seccompProfile:
                type: RuntimeDefault
        restartPolicy: Always
        terminationGracePeriodSeconds: 5
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: calico-node
        serviceAccount: calico-node
        hostNetwork: true
        securityContext: {}
        schedulerName: default-scheduler
        tolerations:
          - key: CriticalAddonsOnly
            operator: Exists
          - operator: Exists
            effect: NoSchedule
          - operator: Exists
            effect: NoExecute
        priorityClassName: system-node-critical
    updateStrategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 1
        maxSurge: 0
    revisionHistoryLimit: 10
  
  ```
  
  where is the pause image configuration? what should I do to find out? I have tried to change the kubelet config and add mirror address like this:
  
  ```
  [root@k8sslave01 kubelet]# systemctl status kubelet --full
  ● kubelet.service - kubelet: The Kubernetes Node Agent
     Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/kubelet.service.d
             └─10-kubeadm.conf
     Active: active (running) since Mon 2024-02-19 12:26:30 CST; 33min ago
       Docs: https://kubernetes.io/docs/
   Main PID: 30876 (kubelet)
      Tasks: 11
     Memory: 84.6M
     CGroup: /system.slice/kubelet.service
             └─30876 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
  
  ```
  
  the `registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6` is the new address. It seems did not work. I have already test the container is accessable:
  
  ```
  [root@k8sslave01 kubelet]# crictl pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6
  Image is up to date for sha256:6270bb605e12e581514ada5fd5b3216f727db55dc87d5889c790e4c760683fee
  
  ```
  
  **Tags:** kubernetes
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2024-02-01. Score: 1
  
  I also catch this issue, steps as bellow can fix it.
  
  1. docker pull docker/desktop-kubernetes-pause:3.8
  2. docker images
     you'll see result like bellow:
  
  > docker/desktop-kubernetes-pause 3.8 4873874c08ef 19 months ago 711kB
  
  // tag pause to registry.k8s.io/pause:3.8  
  3. docker tag 4873874c08ef registry.k8s.io/pause:3.8
  
  // import pause to containerd  
  4. ctr -n k8s.io images import pause.tar  
  5. sudo ctr -n k8s.io images import pause.tar
  
  Then restart kubelet, after kubelet daemon is active and healthy, you can reset k8s cluster, and reinstall k8s again.
  
  > **Comments:**
  > **username_0**: I have already tried like this, but this image will reset in the furture and I have to do this steps again.  
  > **username_1**: Maybe add proxy settings or set a proper repository for containerd can help.  
  
  ---
  
  ### Answer by username_0 on 2024-02-19. Score: 0
  
  I found another way to solve this issue by change the containerd sandbox image:
  
  ```
  version = 2
  [plugins."io.containerd.grpc.v1.cri"]
    #sandbox_image = "k8s.m.daocloud.io/pause:3.6"
    sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6"
  
  ```
  
  replace the `sandbox_image` to any mirror address you can access.
  
  
  ---
  
  