instruction: Create a Dockerfile for fundamentals
output: ```dockerfile
  from a package (for example, RPM or .deb), you may find
  that the CRI integration plugin is disabled by default.
  You need CRI support enabled to use containerd with Kubernetes. Make sure that cri
  is not included in thedisabled_plugins list within /etc/containerd/config.toml;
  if you made changes to that file, also restart containerd.
  If you experience container crash loops after the initial cluster installation or after
  installing a CNI, the containerd configuration provided with the package might contain
  incompatible configuration parameters. Consider resetting the containerd configuration
  with containerd config default > /etc/containerd/config.toml as specified in
  getting-started.md
  and then set the configuration parameters specified above accordingly.
  
  If you apply this change, make sure to restart containerd:
  sudo systemctl restart containerd
  When using kubeadm, manually configure the
  cgroup driver for kubelet.
  In Kubernetes v1.28, you can enable automatic detection of the
  cgroup driver as an alpha feature. See systemd cgroup driver
  for more details.
  Overriding the sandbox (pause) image
  In your containerd config you can overwrite the
  sandbox image by setting the following config:
  [plugins."io.containerd.grpc.v1.cri"]
   sandbox_image = "registry.k8s.io/pause:3.2"
  You might need to restart containerd as well once you've updated the config file: systemctl restart containerd.
  Please note, that it is a best practice for kubelet to declare the matching pod-infra-container-image.
  If not configured, kubelet may attempt to garbage collect the pause image.
  There is ongoing work in containerd to pin the pause image
  and not require this setting on kubelet any longer.
  CRI-O
  This section contains the necessary steps to install CRI-O as a container runtime.
  To install CRI-O, follow CRI-O Install Instructions.
  cgroup driver
  CRI-O uses the systemd cgroup driver per default, which is likely to work fine
  for you. To switch to the cgroupfs cgroup driver, either edit
  /etc/crio/crio.conf or place a drop-in configuration in
  /etc/crio/crio.conf.d/02-cgroup-manager.conf, for example:
  [crio.runtime]
  conmon_cgroup = "pod"
  cgroup_manager = "cgroupfs"
  You should also note the changed conmon_cgroup, which has to be set to the value
  pod when using CRI-O with cgroupfs. It is generally necessary to keep the
  cgroup driver configuration of the kubelet (usually done via kubeadm) and CRI-O
  in sync.
  In Kubernetes v1.28, you can enable automatic detection of the
  cgroup driver as an alpha feature. See systemd cgroup driver
  for more details.
  For CRI-O, the CRI socket is /var/run/crio/crio.sock by default.
  Overriding the sandbox (pause) image
  In your CRI-O config you can set the following
  config value:
  [crio.image]
  pause_image="registry.k8s.io/pause:3.6"
  This config option supports live configuration reload to apply this change: systemctl reload crio or by sending
  SIGHUP to the crio process.
  Docker Engine
  Note:These instructions assume that you are using the
  cri-dockerd adapter to integrate
  Docker Engine with Kubernetes.
  
  On each of your nodes, install Docker for your Linux distribution as per
  Install Docker Engine.
  
  Install cri-dockerd, following the directions in the install section of the documentation.
  
  For cri-dockerd, the CRI socket is /run/cri-dockerd.sock by default.
  Mirantis Container Runtime
  Mirantis Container Runtime (MCR) is a commercially
  available container runtime that was formerly known as Docker Enterprise Edition.
  You can use Mirantis Container Runtime with Kubernetes using the open source
  cri-dockerd component, included with MCR.
  To learn more about how to install Mirantis Container Runtime,
  visit MCR Deployment Guide.
  Check the systemd unit named cri-docker.socket to find out the path to the CRI
  socket.
  Overriding the sandbox (pause) image
  The cri-dockerd adapter accepts a command line argument for
  specifying which container image to use as the Pod infrastructure container (“pause image”).
  The command line argument to use is --pod-infra-container-image.
  What's next
  As well as a container runtime, your cluster will need a working
  network plugin.
  
  Items on this page refer to third party products or projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. See the CNCF website guidelines for more details.You should read the content guide before proposing a change that adds an extra third-party link.
  
  Feedback
  Was this page helpful?
  Yes
  No
  
   Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  
   Stack Overflow.
   Open an issue in the GitHub Repository if you want to
  
   report a problem
   or
  
   suggest an improvement.
  
   Last modified July 08, 2024 at 9:39 AM PST: Update CRI-O install link (fc9db8b3fe)
  
    Create child page
   Create an issue
   Print entire section
  
  Install and configure prerequisites
  
  Network configuration
  Enable IPv4 packet forwarding
  
  cgroup drivers
  
  cgroupfs driver
  systemd cgroup driver
  Migrating to the systemd driver in kubeadm managed clusters
  
  CRI version support
  Container runtimes
  
  containerd
  CRI-O
  Docker Engine
  Mirantis Container Runtime
  
  What's next
  
  Documentation
  Blog
  Training
  Partners
  Community
  Case Studies
  
  © 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0
  
  ICP license: 京ICP备17074266号-3
  ```