How to Install CRI-O Container Runtime on Debian 11

CRI-O is an OCI-based implementation of Kubernetes Container Runtime Interface (CRI) Developed to provide an integration path between OCI-compliant runtimes and the Kubelet. It is a lightweight container runtime environment. A container runtime is the software that is responsible for running the containers. When installing kubernetes, you need to install a container runtime into each node in the cluster so that Pods can run there.

CRI-O was developed to provide the following core functions:

Supports multiple image formats including the existing Docker image format
Support for multiple ways to download images including trust and image verification
Container image management (management of image layers, overlay file systems, etc.)
Life cycle management of container processes
Monitoring and logging required to satisfy the CRI
Resource isolation according to CRI

In this guide we will install CRI-O in Debian 11.

# Step 1. Ensure that the server is up to date

It is always a good practice to ensure the system packages are updated. Use this command to ensure our Debian system has up to date packages:

sudo apt update
sudo apt -y upgrade

# Step 2. Set up Kubic repository repository for CRI-O

Add the Kubic repository that hosts binary packages for Debian based systems. If you are using CRI-O with Kubernetes, install the version that corresponds to the Kubernetes version you are setting up.

To install on the following operating systems, set the environment variable OS to the appropriate field in the following table:

Operating system	$OS
Debian Unstable	`Debian_Unstable`
Debian Testing	`Debian_Testing`
Debian 10	`Debian_10`

Then, set $VERSION to the CRI-O version that matches your Kubernetes version. For instance, if you want to install CRI-O 1.22, set VERSION=1.22. You can pin your installation to a specific release. To install version 1.22.0, set VERSION=1.2:1.22.0.

Ensure you run these as root

OS=Debian_10
VERSION=1.22

echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ /" > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
echo "deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ /" > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list

curl -L https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/Release.key | apt-key add -
curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | apt-key add -

# Step 3: Install CRI-O

We can now install CRI-O after ensuring that our repositories are up to date.

sudo apt update
sudo apt install cri-o cri-o-runc

To confirm the installed version, use this command:

$ apt-cache policy cri-o
cri-o:
  Installed: 1.22.1~1
  Candidate: 1.22.1~1
  Version table:
 *** 1.22.1~1 500
        500 http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/1.22/Debian_10  Packages
        100 /var/lib/dpkg/status

# Step 4. Start and enable CRI-O

Let us reload systemd units and start the service while enabling it on boot.

sudo systemctl daemon-reload
sudo systemctl enable crio --now

Confirm the app status:

$ sudo systemctl status crio
● crio.service - Container Runtime Interface for OCI (CRI-O)
     Loaded: loaded (/lib/systemd/system/crio.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-02-15 19:39:14 UTC; 20s ago
       Docs: https://github.com/cri-o/cri-o
   Main PID: 11861 (crio)
      Tasks: 10
     Memory: 14.3M
        CPU: 167ms
     CGroup: /system.slice/crio.service
             └─11861 /usr/bin/crio

Feb 15 19:39:13 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:13.991075373Z" level=info msg="Conmon does support the --sync option"
Feb 15 19:39:13 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:13.991535237Z" level=info msg="No seccomp profile specified, using the internal default"
Feb 15 19:39:13 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:13.991678982Z" level=info msg="Installing default AppArmor profile: crio-default"
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.054183477Z" level=info msg="No blockio config file specified, blockio not configured"
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.054221522Z" level=info msg="RDT not available in the host system"
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.057341532Z" level=info msg="Found CNI network crio (type=bridge) at /etc/cni/net.d/100-crio>
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.059912105Z" level=info msg="Found CNI network 200-loopback.conf (type=loopback) at /etc/cni>
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.059940248Z" level=info msg="Updated default CNI network name to crio"
Feb 15 19:39:14 cloudsrv.citizix.com crio[11861]: time="2022-02-15 19:39:14.160345518Z" level=warning msg="Error encountered when checking whether cri-o should wipe im>
Feb 15 19:39:14 cloudsrv.citizix.com systemd[1]: Started Container Runtime Interface for OCI (CRI-O).

# Step 5. Using CRI-O on Debian 11

The command line tool **crioctl **can be installed via the cri-tools package.

sudo apt install cri-tools

We can now check existence of crictl Command:

$ sudo crictl info
{
  "status": {
    "conditions": [
      {
        "type": "RuntimeReady",
        "status": true,
        "reason": "",
        "message": ""
      },
      {
        "type": "NetworkReady",
        "status": true,
        "reason": "",
        "message": ""
      }
    ]
  }
}

Pull Nginx image

$ sudo crictl pull nginx:latest
Image is up to date for docker.io/library/nginx@sha256:2834dc507516af02784808c5f48b7cbe38b8ed5d0f4837f16e78d00deb7e7767

List available images:

$ sudo crictl images
IMAGE                     TAG                 IMAGE ID            SIZE
docker.io/library/nginx   latest              c316d5a335a5c       146MB

# Conclusion

That is it. We have managed to install CRI-O in Debian. Enjoy using CRI-O on Debian with Kubernetes.