Answers: <p>I am facing the same issue, for me, I add the <code>version = 2</code> config in <code>/etc/containerd/config.toml</code> and it works:</p>
  <pre><code>version = 2
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
     config_path = &quot;/etc/containerd/certs.d&quot;
  
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;]
    #sandbox_image = &quot;k8s.m.daocloud.io/pause:3.6&quot;
    sandbox_image = &quot;registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6&quot;
  </code></pre>
  <p>check the new sandbox image address:</p>
  <pre><code>[root@k8sslave01 ~]# crictl info|grep pause
      &quot;sandboxImage&quot;: &quot;registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6&quot;,
  </code></pre>
  <p>this is the official config doc: <a href="https://github.com/containerd/cri/blob/master/docs/config.md" rel="nofollow noreferrer">https://github.com/containerd/cri/blob/master/docs/config.md</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-19T11:56:43.093Z
Answers: 2024-02-19T12:06:21.433Z
Answers: 2024-02-19T12:06:21.433Z
Answers: Dolphin
Body: <p><strong>System</strong></p>
  <p>Ubuntu 22.04.01</p>
  <p>kubeadm v1.25.4</p>
  <p>containerd 1.6.10</p>
  <p><strong>Description</strong></p>
  <p>I'm trying to setup k8s 1.25.4 with a private docker repository and the containerd runtime.</p>
  <p>I followed the <a href="https://kubernetes.io/docs/setup/production-environment/container-runtimes/" rel="nofollow noreferrer">docs</a> to overwrite the sandbox image in <code>/etc/containerd/config.toml</code>:</p>
  <pre><code>...
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;]
    sandbox_image = &quot;my-private-registry:5000/registry.k8s.io/pause:3.8&quot;
  ...
  </code></pre>
  <p>Afterwards, the containerd service, and later the machine, was restarted.</p>
  <p>However, when trying to initialize the k8s cluster with kubeadm (<code>kubeadm init --config cluster-config.yml</code>), the initalization failed with <code>journalctl -exu containerd</code> showing the following output:</p>
  <pre><code>Dec 14 11:04:00 myhost containerd[866]: time=&quot;2022-12-14T11:04:00.911273848Z&quot; level=info msg=&quot;trying next host&quot; error=&quot;failed to do request: Head \&quot;https://registry.k8s.io/v2/pause/manifests/3.6\&quot;: dial tcp 34.107.244.51:443: i/o timeout&quot; host=registry.k8s.io
  Dec 14 11:04:00 myhost containerd[866]: time=&quot;2022-12-14T11:04:00.927516068Z&quot; level=error msg=&quot;RunPodSandbox for &amp;PodSandboxMetadata{Name:myhost,Uid:c4ebaf5ac4e21e7bc99cda96857ec39e,Namespace:kube-system,Attempt:0,} failed, error&quot; error=&quot;failed to get sandbox image \&quot;registry.k8s.io/pause:3.6\&quot;: failed to pull image \&quot;registry.k8s.io/pause:3.6\&quot;: failed to pull and unpack image \&quot;registry.k8s.io/pause:3.6\&quot;: failed to resolve reference \&quot;registry.k8s.io/pause:3.6\&quot;: failed to do request: Head \&quot;https://registry.k8s.io/v2/pause/manifests/3.6\&quot;: dial tcp 34.107.244.51:443: i/o timeout&quot;
  </code></pre>
  <p>This indicates to me that the sandbox image overwrite was unsuccessful. <code>cluster-config.yml</code> is configured to use the private registry and kubeadm can succesfully pull the k8s images (including the sandbox image):</p>
  <pre><code>...
  imageRepository: my-private-registry:5000
  ...
  </code></pre>
  <p>What am I missing here?</p>
  
Comments: CC BY-SA 4.0
Comments: 2023-01-18T10:52:02.530Z
Comments: Try to add "version = 2" to your "/etc/containerd/config.toml".
Comments: Jörg Friede
Comments: CC BY-SA 4.0
Comments: 2023-11-22T05:08:31.317Z
Comments: did you fixed this issue?
Comments: Dolphin
Tags: <kubernetes><kubeadm><containerd>
Title: containerd: Unable to overwrite sandbox image
UserDisplayName: danteu
ThreadText: # containerd: Unable to overwrite sandbox image
  
  (Asked by: username_0 on 2022-12-14)
  
  **System**
  
  Ubuntu 22.04.01
  
  kubeadm v1.25.4
  
  containerd 1.6.10
  
  **Description**
  
  I'm trying to setup k8s 1.25.4 with a private docker repository and the containerd runtime.
  
  I followed the [docs](https://kubernetes.io/docs/setup/production-environment/container-runtimes/) to overwrite the sandbox image in `/etc/containerd/config.toml`:
  
  ```
  ...
  [plugins."io.containerd.grpc.v1.cri"]
    sandbox_image = "my-private-registry:5000/registry.k8s.io/pause:3.8"
  ...
  
  ```
  
  Afterwards, the containerd service, and later the machine, was restarted.
  
  However, when trying to initialize the k8s cluster with kubeadm (`kubeadm init --config cluster-config.yml`), the initalization failed with `journalctl -exu containerd` showing the following output:
  
  ```
  Dec 14 11:04:00 myhost containerd[866]: time="2022-12-14T11:04:00.911273848Z" level=info msg="trying next host" error="failed to do request: Head \"https://registry.k8s.io/v2/pause/manifests/3.6\": dial tcp 34.107.244.51:443: i/o timeout" host=registry.k8s.io
  Dec 14 11:04:00 myhost containerd[866]: time="2022-12-14T11:04:00.927516068Z" level=error msg="RunPodSandbox for &PodSandboxMetadata{Name:myhost,Uid:c4ebaf5ac4e21e7bc99cda96857ec39e,Namespace:kube-system,Attempt:0,} failed, error" error="failed to get sandbox image \"registry.k8s.io/pause:3.6\": failed to pull image \"registry.k8s.io/pause:3.6\": failed to pull and unpack image \"registry.k8s.io/pause:3.6\": failed to resolve reference \"registry.k8s.io/pause:3.6\": failed to do request: Head \"https://registry.k8s.io/v2/pause/manifests/3.6\": dial tcp 34.107.244.51:443: i/o timeout"
  
  ```
  
  This indicates to me that the sandbox image overwrite was unsuccessful. `cluster-config.yml` is configured to use the private registry and kubeadm can succesfully pull the k8s images (including the sandbox image):
  
  ```
  ...
  imageRepository: my-private-registry:5000
  ...
  
  ```
  
  What am I missing here?
  
  **Tags:** kubernetes, kubeadm, containerd
  
  > **Comments:**
  > **username_1**: Try to add "version = 2" to your "/etc/containerd/config.toml".  
  > **username_2**: did you fixed this issue?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2024-02-19. Score: 1
  
  I am facing the same issue, for me, I add the `version = 2` config in `/etc/containerd/config.toml` and it works:
  
  ```
  version = 2
  [plugins."io.containerd.grpc.v1.cri".registry]
     config_path = "/etc/containerd/certs.d"
  
  [plugins."io.containerd.grpc.v1.cri"]
    #sandbox_image = "k8s.m.daocloud.io/pause:3.6"
    sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6"
  
  ```
  
  check the new sandbox image address:
  
  ```
  [root@k8sslave01 ~]# crictl info|grep pause
      "sandboxImage": "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6",
  
  ```
  
  this is the official config doc: <https://github.com/containerd/cri/blob/master/docs/config.md>
  
  
  ---
  
  