How to Install CRI-O Container Runtime on Debian 11

Pinterest LinkedIn Tumblr

CRI-O is an OCI-based implementation of Kubernetes Container Runtime Interface (CRI) Developed to provide an integration path between OCI-compliant runtimes and the Kubelet. It is a lightweight container runtime environment. A container runtime is the software that is responsible for running the containers. When installing kubernetes, you need to install a container runtime into each node in the cluster so that Pods can run there.

CRI-O was developed to provide the following core functions:

  • Supports multiple image formats including the existing Docker image format
  • Support for multiple ways to download images including trust and image verification
  • Container image management (management of image layers, overlay file systems, etc.)
  • Life cycle management of container processes
  • Monitoring and logging required to satisfy the CRI
  • Resource isolation according to CRI

In this guide we will install CRI-O in Debian 11.

Related Content:

Step 1. Ensure that the server is up to date

It is always a good practice to ensure the system packages are updated. Use this command to ensure our Debian system has up to date packages:

sudo apt update
sudo apt -y upgrade

Step 2. Set up Kubic repository repository for CRI-O

Add the Kubic repository that hosts binary packages for Debian based systems. If you are using CRI-O with Kubernetes, install the version that corresponds to the Kubernetes version you are setting up.

To install on the following operating systems, set the environment variable OS to the appropriate field in the following table:

Operating system$OS
Debian UnstableDebian_Unstable
Debian TestingDebian_Testing
Debian 10Debian_10
CRI-O Debian

Then, set $VERSION to the CRI-O version that matches your Kubernetes version. For instance, if you want to install CRI-O 1.22, set VERSION=1.22. You can pin your installation to a specific release. To install version 1.22.0, set VERSION=1.2:1.22.0.

Ensure you run these as root


echo "deb$OS/ /" > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
echo "deb$VERSION/$OS/ /" > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list

curl -L$VERSION/$OS/Release.key | apt-key add -
curl -L$OS/Release.key | apt-key add -

Step 3: Install CRI-O

We can now install CRI-O after ensuring that our repositories are up to date.

sudo apt update
sudo apt install cri-o cri-o-runc

To confirm the installed version, use this command:

$ apt-cache policy cri-o
  Installed: 1.22.1~1
  Candidate: 1.22.1~1
  Version table:
 *** 1.22.1~1 500
        500  Packages
        100 /var/lib/dpkg/status

Step 4. Start and enable CRI-O

Let us reload systemd units and start the service while enabling it on boot.

sudo systemctl daemon-reload
sudo systemctl enable crio --now

Confirm the app status:

$ sudo systemctl status crio
● crio.service - Container Runtime Interface for OCI (CRI-O)
     Loaded: loaded (/lib/systemd/system/crio.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-02-15 19:39:14 UTC; 20s ago
   Main PID: 11861 (crio)
      Tasks: 10
     Memory: 14.3M
        CPU: 167ms
     CGroup: /system.slice/crio.service
             └─11861 /usr/bin/crio

Feb 15 19:39:13 crio[11861]: time="2022-02-15 19:39:13.991075373Z" level=info msg="Conmon does support the --sync option"
Feb 15 19:39:13 crio[11861]: time="2022-02-15 19:39:13.991535237Z" level=info msg="No seccomp profile specified, using the internal default"
Feb 15 19:39:13 crio[11861]: time="2022-02-15 19:39:13.991678982Z" level=info msg="Installing default AppArmor profile: crio-default"
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.054183477Z" level=info msg="No blockio config file specified, blockio not configured"
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.054221522Z" level=info msg="RDT not available in the host system"
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.057341532Z" level=info msg="Found CNI network crio (type=bridge) at /etc/cni/net.d/100-crio>
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.059912105Z" level=info msg="Found CNI network 200-loopback.conf (type=loopback) at /etc/cni>
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.059940248Z" level=info msg="Updated default CNI network name to crio"
Feb 15 19:39:14 crio[11861]: time="2022-02-15 19:39:14.160345518Z" level=warning msg="Error encountered when checking whether cri-o should wipe im>
Feb 15 19:39:14 systemd[1]: Started Container Runtime Interface for OCI (CRI-O).

Step 5. Using CRI-O on Debian 11

The command line tool crioctl can be installed via the cri-tools package.

sudo apt install cri-tools

We can now check existence of crictl Command:

$ sudo crictl info
  "status": {
    "conditions": [
        "type": "RuntimeReady",
        "status": true,
        "reason": "",
        "message": ""
        "type": "NetworkReady",
        "status": true,
        "reason": "",
        "message": ""

Pull Nginx image

$ sudo crictl pull nginx:latest
Image is up to date for[email protected]:2834dc507516af02784808c5f48b7cbe38b8ed5d0f4837f16e78d00deb7e7767

List available images:

$ sudo crictl images
IMAGE                     TAG                 IMAGE ID            SIZE   latest              c316d5a335a5c       146MB


That is it. We have managed to install CRI-O in Debian. Enjoy using CRI-O on Debian with Kubernetes.

I am a Devops Engineer, but I would describe myself as a Tech Enthusiast who is a fan of Open Source, Linux, Automations, Cloud and Virtualization. I love learning and exploring new things so I blog in my free time about Devops related stuff, Linux, Automations and Open Source software. I can also code in Python and Golang.

Write A Comment