<p>I am trying to create a k8s pod with a docker container image from a private insecure registry. With the latest K8s, I get ErrImagePull as it complains of http vs https for the insecure registry.</p>
<pre><code>  Type     Reason     Age   From               Message
  ----     ------     ----  ----               -------
  Normal   Scheduled  7s    default-scheduler  Successfully assigned imagename to xxxx
  Normal   Pulling    7s    kubelet            Pulling image &quot;registry:5000/imagename:v1”
  Warning  Failed     6s    kubelet            Failed to pull image &quot;registry:5000/imagename:v1”: rpc error: code = Unknown desc = failed to pull and unpack image &quot;registry:5000/imagename:v1”: failed to resolve reference &quot;registry:5000/imagename:v1”: failed to do request: Head &quot;https://registry:5000/v2/imagename/manifests/v1”: http: server gave HTTP response to HTTPS client
  Warning  Failed     6s    kubelet            Error: ErrImagePull
  Normal   BackOff    6s    kubelet            Back-off pulling image &quot;registry:5000/imagename:v1”
  Warning  Failed     6s    kubelet            Error: ImagePullBackOff
</code></pre>
<p>Before the CRI changes for K8s (i.e. <a href="https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/" rel="nofollow noreferrer">https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/</a>), this has worked for me when I used to have insecure registry configuration in /etc/docker/daemon.json, however with the new changes in K8s, I am trying to understand what is the right configuration needed here.</p>
<p>On the same node, I am able to pull the image from the insecure registry successfully with “docker pull imagename” (since I have /etc/docker/daemon.json configuration for the insecure registry), and I have also verified with containerd command “ctr -i pull —plain-http imagename”.</p>
<p>What configuration is needed for this to work in a pod.yaml for me to pull this image via “kubectl create -f pod.yaml”. It's just a simple pod.yaml with the image, nothing fancy.</p>
<p>I saw a post on creating secret key for private registry (<a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a>), but that requires registry authentication token to create a key. I just tried using /etc/docker/daemon.json to create a regcred, but when I used it in imagePullSecrets in pod.yaml, k8s was still complaining of the same http vs https error.</p>
<p>My /etc/docker/daemon.json</p>
<pre><code>{
    &quot;insecure-registries&quot;: [&quot;registry:5000&quot;]
}
</code></pre>
<p>I have a new install of K8s, and containerd is the CRI.</p>
<p>Thank you for your help.</p>

<p>I faced a similar problem recently about not being able to pull images from an insecure private docker registry using containerd only. I will post my solution here in case it works for your question too. Steps below show the details of how I solved it on Ubuntu Server 20.04 LTS:</p>
<pre><code>$ containerd --version\
containerd containerd.io 1.6.4 212e8b6fa2f44b9c21b2798135fc6fb7c53efc16
</code></pre>
<p>insecure private docker registry running at 17.5.20.23:5000</p>
<p>The file <code>/etc/containerd/config.toml</code> gets created automatically when you install docker using <code>.deb</code> packages in ubuntu looks as follows:</p>
<pre><code>#   Copyright 2018-2022 Docker Inc.

#   Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at

#       http://www.apache.org/licenses/LICENSE-2.0

#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an &quot;AS IS&quot; BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

#disabled_plugins = [&quot;cri&quot;]

#root = &quot;/var/lib/containerd&quot;
#state = &quot;/run/containerd&quot;
#subreaper = true
#oom_score = 0

#[grpc]
#  address = &quot;/run/containerd/containerd.sock&quot;
#  uid = 0
#  gid = 0

#[debug]
#  address = &quot;/run/containerd/debug.sock&quot;
#  uid = 0
#  gid = 0
#  level = &quot;info&quot;
</code></pre>
<p>In my first few attempts I was editing this file (which is created automatically) by simply adding the appropriate lines mentioned at <a href="https://stackoverflow.com/questions/65681045/adding-insecure-registry-in-containerd">Adding insecure registry in containerd</a> at the end of the file and restarting containerd. This made the file look as follows:</p>
<pre><code>#   Copyright 2018-2022 Docker Inc.

#   Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at

#       http://www.apache.org/licenses/LICENSE-2.0

#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an &quot;AS IS&quot; BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

#disabled_plugins = [&quot;cri&quot;]

#root = &quot;/var/lib/containerd&quot;
#state = &quot;/run/containerd&quot;
#subreaper = true
#oom_score = 0

#[grpc]
#  address = &quot;/run/containerd/containerd.sock&quot;
#  uid = 0
#  gid = 0

#[debug]
#  address = &quot;/run/containerd/debug.sock&quot;
#  uid = 0
#  gid = 0
#  level = &quot;info&quot;

[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;17.5.20.23:5000&quot;]
      endpoint = [&quot;http://17.5.20.23:5000&quot;]
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;17.5.20.23:5000&quot;.tls]
      insecure_skip_verify = true
</code></pre>
<p>This did not work for me. To know why, I checked the configurations with which containerd was running (after <code>/etc/containerd/config.toml</code> was edited) using:</p>
<pre><code>$ sudo containerd config dump
</code></pre>
<p>The output of the above command is shown below:</p>
<pre><code>disabled_plugins = []
imports = [&quot;/etc/containerd/config.toml&quot;]
oom_score = 0
plugin_dir = &quot;&quot;
required_plugins = []
root = &quot;/var/lib/containerd&quot;
state = &quot;/run/containerd&quot;
temp = &quot;&quot;
version = 2

[cgroup]
  path = &quot;&quot;

[debug]
  address = &quot;&quot;
  format = &quot;&quot;
  gid = 0
  level = &quot;&quot;
  uid = 0

[grpc]
  address = &quot;/run/containerd/containerd.sock&quot;
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = &quot;&quot;
  tcp_tls_ca = &quot;&quot;
  tcp_tls_cert = &quot;&quot;
  tcp_tls_key = &quot;&quot;
  uid = 0

[metrics]
  address = &quot;&quot;
  grpc_histogram = false

[plugins]

  [plugins.&quot;io.containerd.gc.v1.scheduler&quot;]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = &quot;0s&quot;
    startup_delay = &quot;100ms&quot;

  [plugins.&quot;io.containerd.internal.v1.opt&quot;]
    path = &quot;/opt/containerd&quot;

  [plugins.&quot;io.containerd.internal.v1.restart&quot;]
    interval = &quot;10s&quot;

  [plugins.&quot;io.containerd.internal.v1.tracing&quot;]
    sampling_ratio = 1.0
    service_name = &quot;containerd&quot;

  [plugins.&quot;io.containerd.metadata.v1.bolt&quot;]
    content_sharing_policy = &quot;shared&quot;

  [plugins.&quot;io.containerd.monitor.v1.cgroups&quot;]
    no_prometheus = false

  [plugins.&quot;io.containerd.runtime.v1.linux&quot;]
    no_shim = false
    runtime = &quot;runc&quot;
    runtime_root = &quot;&quot;
    shim = &quot;containerd-shim&quot;
    shim_debug = false

  [plugins.&quot;io.containerd.runtime.v2.task&quot;]
    platforms = [&quot;linux/amd64&quot;]
    sched_core = false
 
  [plugins.&quot;io.containerd.service.v1.diff-service&quot;]
    default = [&quot;walking&quot;]

  [plugins.&quot;io.containerd.service.v1.tasks-service&quot;]
    rdt_config_file = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.aufs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.btrfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.devmapper&quot;]
    async_remove = false
    base_image_size = &quot;&quot;
    discard_blocks = false
    fs_options = &quot;&quot;
    fs_type = &quot;&quot;
    pool_name = &quot;&quot;
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.native&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.overlayfs&quot;]
    root_path = &quot;&quot;
    upperdir_label = false

  [plugins.&quot;io.containerd.snapshotter.v1.zfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.tracing.processor.v1.otlp&quot;]
    endpoint = &quot;&quot;
    insecure = false
    protocol = &quot;&quot;

[proxy_plugins]

[stream_processors]

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar&quot;

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar.gzip&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+gzip+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar+gzip&quot;

[timeouts]
  &quot;io.containerd.timeout.bolt.open&quot; = &quot;0s&quot;
  &quot;io.containerd.timeout.shim.cleanup&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.load&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.shutdown&quot; = &quot;3s&quot;
  &quot;io.containerd.timeout.task.state&quot; = &quot;2s&quot;

[ttrpc]
  address = &quot;&quot;
  gid = 0
  uid = 0
</code></pre>
<p>In the above output I noticed that the configurations I was trying to add by editing the <code>/etc/containerd/config.toml</code> were actually not there. So somehow containerd was not accepting the added configurations. To fix this I decided to start from scratch by generating a full configuration file and editing it appropriately (according to instructions at <a href="https://stackoverflow.com/questions/65681045/adding-insecure-registry-in-containerd">Adding insecure registry in containerd</a>).</p>
<p>First took a backup of the current containerd configuration file:</p>
<pre><code>$ sudo su
$ cd /etc/containerd/
$ mv config.toml config_bkup.toml
</code></pre>
<p>Then generated a fresh full configuration file:</p>
<pre><code>$ containerd config default &gt; config.toml
</code></pre>
<p>This generated a file that looked as follows:</p>
<pre><code>disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = &quot;&quot;
required_plugins = []
root = &quot;/var/lib/containerd&quot;
state = &quot;/run/containerd&quot;
temp = &quot;&quot;
version = 2

[cgroup]
  path = &quot;&quot;

[debug]
  address = &quot;&quot;
  format = &quot;&quot;
  gid = 0
  level = &quot;&quot;
  uid = 0

[grpc]
  address = &quot;/run/containerd/containerd.sock&quot;
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = &quot;&quot;
  tcp_tls_ca = &quot;&quot;
  tcp_tls_cert = &quot;&quot;
  tcp_tls_key = &quot;&quot;
  uid = 0

[metrics]
  address = &quot;&quot;
  grpc_histogram = false

[plugins]

  [plugins.&quot;io.containerd.gc.v1.scheduler&quot;]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = &quot;0s&quot;
    startup_delay = &quot;100ms&quot;

  [plugins.&quot;io.containerd.grpc.v1.cri&quot;]
    device_ownership_from_security_context = false
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    enable_selinux = false
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_image_defined_volumes = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = &quot;k8s.gcr.io/pause:3.6&quot;
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = &quot;4h0m0s&quot;
    stream_server_address = &quot;127.0.0.1&quot;
    stream_server_port = &quot;0&quot;
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = &quot;&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.cni]
      bin_dir = &quot;/opt/cni/bin&quot;
      conf_dir = &quot;/etc/cni/net.d&quot;
      conf_template = &quot;&quot;
      ip_pref = &quot;&quot;
      max_conf_num = 1

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd]
      default_runtime_name = &quot;runc&quot;
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      ignore_rdt_not_enabled_errors = false
      no_pivot = false
      snapshotter = &quot;overlayfs&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.default_runtime]
        base_runtime_spec = &quot;&quot;
        cni_conf_dir = &quot;&quot;
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = &quot;&quot;
        runtime_path = &quot;&quot;
        runtime_root = &quot;&quot;
        runtime_type = &quot;&quot;

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.default_runtime.options]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes]

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.runc]
          base_runtime_spec = &quot;&quot;
          cni_conf_dir = &quot;&quot;
          cni_max_conf_num = 0
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          runtime_engine = &quot;&quot;
          runtime_path = &quot;&quot;
          runtime_root = &quot;&quot;
          runtime_type = &quot;io.containerd.runc.v2&quot;

          [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.runc.options]
            BinaryName = &quot;&quot;
            CriuImagePath = &quot;&quot;
            CriuPath = &quot;&quot;
            CriuWorkPath = &quot;&quot;
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            NoPivotRoot = false
            Root = &quot;&quot;
            ShimCgroup = &quot;&quot;
            SystemdCgroup = false

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.untrusted_workload_runtime]
        base_runtime_spec = &quot;&quot;
        cni_conf_dir = &quot;&quot;
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = &quot;&quot;
        runtime_path = &quot;&quot;
        runtime_root = &quot;&quot;
        runtime_type = &quot;&quot;

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.untrusted_workload_runtime.options]

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.image_decryption]
      key_model = &quot;node&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
      config_path = &quot;&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.auths]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.headers]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.x509_key_pair_streaming]
      tls_cert_file = &quot;&quot;
      tls_key_file = &quot;&quot;

  [plugins.&quot;io.containerd.internal.v1.opt&quot;]
    path = &quot;/opt/containerd&quot;

  [plugins.&quot;io.containerd.internal.v1.restart&quot;]
    interval = &quot;10s&quot;

  [plugins.&quot;io.containerd.internal.v1.tracing&quot;]
    sampling_ratio = 1.0
    service_name = &quot;containerd&quot;

  [plugins.&quot;io.containerd.metadata.v1.bolt&quot;]
    content_sharing_policy = &quot;shared&quot;

  [plugins.&quot;io.containerd.monitor.v1.cgroups&quot;]
    no_prometheus = false

  [plugins.&quot;io.containerd.runtime.v1.linux&quot;]
    no_shim = false
    runtime = &quot;runc&quot;
    runtime_root = &quot;&quot;
    shim = &quot;containerd-shim&quot;
    shim_debug = false

  [plugins.&quot;io.containerd.runtime.v2.task&quot;]
    platforms = [&quot;linux/amd64&quot;]
    sched_core = false

  [plugins.&quot;io.containerd.service.v1.diff-service&quot;]
    default = [&quot;walking&quot;]

  [plugins.&quot;io.containerd.service.v1.tasks-service&quot;]
    rdt_config_file = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.aufs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.btrfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.devmapper&quot;]
    async_remove = false
    base_image_size = &quot;&quot;
    discard_blocks = false
    fs_options = &quot;&quot;
    fs_type = &quot;&quot;
    pool_name = &quot;&quot;
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.native&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.overlayfs&quot;]
    root_path = &quot;&quot;
    upperdir_label = false

  [plugins.&quot;io.containerd.snapshotter.v1.zfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.tracing.processor.v1.otlp&quot;]
    endpoint = &quot;&quot;
    insecure = false
    protocol = &quot;&quot;

[proxy_plugins]

[stream_processors]

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar&quot;

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar.gzip&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+gzip+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar+gzip&quot;

[timeouts]
  &quot;io.containerd.timeout.bolt.open&quot; = &quot;0s&quot;
  &quot;io.containerd.timeout.shim.cleanup&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.load&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.shutdown&quot; = &quot;3s&quot;
  &quot;io.containerd.timeout.task.state&quot; = &quot;2s&quot;

[ttrpc]
  address = &quot;&quot;
  gid = 0
  uid = 0
</code></pre>
<p>Then edited the above file to look as follows (the edited lines have been appended with the comment '# edited line'):</p>
<pre><code>disabled_plugins = []
imports = [&quot;/etc/containerd/config.toml&quot;] # edited line
oom_score = 0
plugin_dir = &quot;&quot;
required_plugins = []
root = &quot;/var/lib/containerd&quot;
state = &quot;/run/containerd&quot;
temp = &quot;&quot;
version = 2

[cgroup]
  path = &quot;&quot;

[debug]
  address = &quot;&quot;
  format = &quot;&quot;
  gid = 0
  level = &quot;&quot;
  uid = 0

[grpc]
  address = &quot;/run/containerd/containerd.sock&quot;
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = &quot;&quot;
  tcp_tls_ca = &quot;&quot;
  tcp_tls_cert = &quot;&quot;
  tcp_tls_key = &quot;&quot;
  uid = 0

[metrics]
  address = &quot;&quot;
  grpc_histogram = false

[plugins]

  [plugins.&quot;io.containerd.gc.v1.scheduler&quot;]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = &quot;0s&quot;
    startup_delay = &quot;100ms&quot;

  [plugins.&quot;io.containerd.grpc.v1.cri&quot;]
    device_ownership_from_security_context = false
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    enable_selinux = false
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_image_defined_volumes = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = &quot;17.5.20.23:5000/pause-amd64:3.0&quot; #edited line
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = &quot;4h0m0s&quot;
    stream_server_address = &quot;127.0.0.1&quot;
    stream_server_port = &quot;0&quot;
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = &quot;&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.cni]
      bin_dir = &quot;/opt/cni/bin&quot;
      conf_dir = &quot;/etc/cni/net.d&quot;
      conf_template = &quot;&quot;
      ip_pref = &quot;&quot;
      max_conf_num = 1

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd]
      default_runtime_name = &quot;runc&quot;
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      ignore_rdt_not_enabled_errors = false
      no_pivot = false
      snapshotter = &quot;overlayfs&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.default_runtime]
        base_runtime_spec = &quot;&quot;
        cni_conf_dir = &quot;&quot;
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = &quot;&quot;
        runtime_path = &quot;&quot;
        runtime_root = &quot;&quot;
        runtime_type = &quot;&quot;

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.default_runtime.options]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes]

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.runc]
          base_runtime_spec = &quot;&quot;
          cni_conf_dir = &quot;&quot;
          cni_max_conf_num = 0
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          runtime_engine = &quot;&quot;
          runtime_path = &quot;&quot;
          runtime_root = &quot;&quot;
          runtime_type = &quot;io.containerd.runc.v2&quot;

          [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.runc.options]
            BinaryName = &quot;&quot;
            CriuImagePath = &quot;&quot;
            CriuPath = &quot;&quot;
            CriuWorkPath = &quot;&quot;
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            NoPivotRoot = false
            Root = &quot;&quot;
            ShimCgroup = &quot;&quot;
            SystemdCgroup = true # edited line

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.untrusted_workload_runtime]
        base_runtime_spec = &quot;&quot;
        cni_conf_dir = &quot;&quot;
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = &quot;&quot;
        runtime_path = &quot;&quot;
        runtime_root = &quot;&quot;
        runtime_type = &quot;&quot;

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.untrusted_workload_runtime.options]

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.image_decryption]
      key_model = &quot;node&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
      config_path = &quot;&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.auths]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;17.5.20.23:5000&quot;] # edited line

          [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;17.5.20.23:5000&quot;.tls] # edited line
            ca_file = &quot;&quot; # edited line
            cert_file = &quot;&quot; # edited line
            insecure_skip_verify = true # edited line
            key_file = &quot;&quot; # edited line

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.headers]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]

        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;17.5.20.23:5000&quot;] # edited line
          endpoint = [&quot;http://17.5.20.23:5000&quot;] # edited line

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.x509_key_pair_streaming]
      tls_cert_file = &quot;&quot;
      tls_key_file = &quot;&quot;

  [plugins.&quot;io.containerd.internal.v1.opt&quot;]
    path = &quot;/opt/containerd&quot;

  [plugins.&quot;io.containerd.internal.v1.restart&quot;]
    interval = &quot;10s&quot;

  [plugins.&quot;io.containerd.internal.v1.tracing&quot;]
    sampling_ratio = 1.0
    service_name = &quot;containerd&quot;

  [plugins.&quot;io.containerd.metadata.v1.bolt&quot;]
    content_sharing_policy = &quot;shared&quot;

  [plugins.&quot;io.containerd.monitor.v1.cgroups&quot;]
    no_prometheus = false

  [plugins.&quot;io.containerd.runtime.v1.linux&quot;]
    no_shim = false
    runtime = &quot;runc&quot;
    runtime_root = &quot;&quot;
    shim = &quot;containerd-shim&quot;
    shim_debug = false

  [plugins.&quot;io.containerd.runtime.v2.task&quot;]
    platforms = [&quot;linux/amd64&quot;]
    sched_core = false

  [plugins.&quot;io.containerd.service.v1.diff-service&quot;]
    default = [&quot;walking&quot;]

  [plugins.&quot;io.containerd.service.v1.tasks-service&quot;]
    rdt_config_file = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.aufs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.btrfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.devmapper&quot;]
    async_remove = false
    base_image_size = &quot;&quot;
    discard_blocks = false
    fs_options = &quot;&quot;
    fs_type = &quot;&quot;
    pool_name = &quot;&quot;
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.native&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.snapshotter.v1.overlayfs&quot;]
    root_path = &quot;&quot;
    upperdir_label = false

  [plugins.&quot;io.containerd.snapshotter.v1.zfs&quot;]
    root_path = &quot;&quot;

  [plugins.&quot;io.containerd.tracing.processor.v1.otlp&quot;]
    endpoint = &quot;&quot;
    insecure = false
    protocol = &quot;&quot;

[proxy_plugins]

[stream_processors]

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar&quot;

  [stream_processors.&quot;io.containerd.ocicrypt.decoder.v1.tar.gzip&quot;]
    accepts = [&quot;application/vnd.oci.image.layer.v1.tar+gzip+encrypted&quot;]
    args = [&quot;--decryption-keys-path&quot;, &quot;/etc/containerd/ocicrypt/keys&quot;]
    env = [&quot;OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf&quot;]
    path = &quot;ctd-decoder&quot;
    returns = &quot;application/vnd.oci.image.layer.v1.tar+gzip&quot;

[timeouts]
  &quot;io.containerd.timeout.bolt.open&quot; = &quot;0s&quot;
  &quot;io.containerd.timeout.shim.cleanup&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.load&quot; = &quot;5s&quot;
  &quot;io.containerd.timeout.shim.shutdown&quot; = &quot;3s&quot;
  &quot;io.containerd.timeout.task.state&quot; = &quot;2s&quot;

[ttrpc]
  address = &quot;&quot;
  gid = 0
  uid = 0
</code></pre>
<p>Then I restarted containerd</p>
<pre><code>$ systemctl restart containerd
</code></pre>
<p>Finally I tried pulling an image from the private registry using <code>crictl</code> which pulled it successfully:</p>
<pre><code>$ crictl -r unix:///var/run/containerd/containerd.sock 17.5.20.23:5000/nginx:latest
Image is up to date for sha256:0e901e68141fd02f237cf63eb842529f8a9500636a9419e3cf4fb986b8fe3d5d
</code></pre>
