instruction: Create a Dockerfile for fundamentals
output: ```dockerfile
  from a package (for example, RPM or .deb), you may find
  that the CRI integration plugin is disabled by default.You need CRI support enabled to use containerd with Kubernetes. Make sure that cri
  is not included in thedisabled_plugins list within /etc/containerd/config.toml;
  if you made changes to that file, also restart containerd.If you experience container crash loops after the initial cluster installation or after
  installing a CNI, the containerd configuration provided with the package might contain
  incompatible configuration parameters. Consider resetting the containerd configuration
  with containerd config default > /etc/containerd/config.toml as specified in
  getting-started.md
  and then set the configuration parameters specified above accordingly.If you apply this change, make sure to restart containerd:sudo systemctl restart containerd
  When using kubeadm, manually configure the
  cgroup driver for kubelet.In Kubernetes v1.28, you can enable automatic detection of the
  cgroup driver as an alpha feature. See systemd cgroup driver
  for more details.Overriding the sandbox (pause) imageIn your containerd config you can overwrite the
  sandbox image by setting the following config:[plugins."io.containerd.grpc.v1.cri"]
   sandbox_image = "registry.k8s.io/pause:3.10"
  You might need to restart containerd as well once you've updated the config file: systemctl restart containerd.CRI-OThis section contains the necessary steps to install CRI-O as a container runtime.To install CRI-O, follow CRI-O Install Instructions.cgroup driverCRI-O uses the systemd cgroup driver per default, which is likely to work fine
  for you. To switch to the cgroupfs cgroup driver, either edit
  /etc/crio/crio.conf or place a drop-in configuration in
  /etc/crio/crio.conf.d/02-cgroup-manager.conf, for example:[crio.runtime]
  conmon_cgroup = "pod"
  cgroup_manager = "cgroupfs"
  You should also note the changed conmon_cgroup, which has to be set to the value
  pod when using CRI-O with cgroupfs. It is generally necessary to keep the
  cgroup driver configuration of the kubelet (usually done via kubeadm) and CRI-O
  in sync.In Kubernetes v1.28, you can enable automatic detection of the
  cgroup driver as an alpha feature. See systemd cgroup driver
  for more details.For CRI-O, the CRI socket is /var/run/crio/crio.sock by default.Overriding the sandbox (pause) imageIn your CRI-O config you can set the following
  config value:[crio.image]
  pause_image="registry.k8s.io/pause:3.10"
  This config option supports live configuration reload to apply this change: systemctl reload crio or by sending
  SIGHUP to the crio process.Docker EngineNote:These instructions assume that you are using the
  cri-dockerd adapter to integrate
  Docker Engine with Kubernetes.On each of your nodes, install Docker for your Linux distribution as per
  Install Docker Engine.Install cri-dockerd, following the directions in the install section of the documentation.For cri-dockerd, the CRI socket is /run/cri-dockerd.sock by default.Mirantis Container RuntimeMirantis Container Runtime (MCR) is a commercially
  available container runtime that was formerly known as Docker Enterprise Edition.You can use Mirantis Container Runtime with Kubernetes using the open source
  cri-dockerd component, included with MCR.To learn more about how to install Mirantis Container Runtime,
  visit MCR Deployment Guide.Check the systemd unit named cri-docker.socket to find out the path to the CRI
  socket.Overriding the sandbox (pause) imageThe cri-dockerd adapter accepts a command line argument for
  specifying which container image to use as the Pod infrastructure container (“pause image”).
  The command line argument to use is --pod-infra-container-image.What's nextAs well as a container runtime, your cluster will need a working
  network plugin.Items on this page refer to third party products or projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. See the CNCF website guidelines for more details.You should read the content guide before proposing a change that adds an extra third-party link.FeedbackWas this page helpful?Yes
  NoThanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  Stack Overflow.
  Open an issue in the GitHub Repository if you want to
  report a problem
  or
  suggest an improvement.Last modified July 14, 2025 at 2:10 PM PST: Clarify systemd configuration based on Containerd version (#51386) (7004a73682)  Create child page
   Create an issue
   Print entire sectionInstall and configure prerequisitesNetwork configurationEnable IPv4 packet forwardingcgroup driverscgroupfs driversystemd cgroup driverMigrating to the systemd driver in kubeadm managed clustersCRI version supportContainer runtimescontainerdCRI-ODocker EngineMirantis Container RuntimeWhat's next© 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0© 2025 The Linux Foundation ®. ```