<p>I init the latest kubernetes v1.25.2 with kubeadm, containerd as runtime.</p>
<p>Then config /etc/containerd/certs.d/my_registry:5000/hosts.toml in order to pull images from the private registry.</p>
<p>Command like this:</p>
<pre><code>$ crictl pull my_registry:5000/hello-world:latest
</code></pre>
<p>The result is successful! But my registry requires account/password when using 'docker pull'.</p>
<p>Why does this happen?</p>

wujinbin
<p><code>crictl</code> is only <em>using</em> your container runtime. In your case, it is using containerd to actually do the pull. That means if you already have the configuration for containerd to authenticate, that will work out of the box with crictl.</p>
<p>How authentication for containerd works is lined out <a href="https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration" rel="nofollow noreferrer">here</a> and you can check if that is what you are actually using with the following command:</p>
<pre><code>cat /etc/crictl.yaml

</code></pre>
<p>If that file does not exist, you will use the defaults, which are deprecated.</p>
