Project: CRI-O (Runtime / Container Runtime)
File: install.md

<!-- markdownlint-disable-next-line MD041 --> This guide will walk you through the installation of , an Open Container Initiative-based implementation of the . It is assumed you are running a Linux machine. <!-- TOC start --> - - - - - - - - - - - - - - - <!-- TOC end --> CRI-O follows the of three minor releases. CRI-O also attempts to package for the following operating systems: ```text Fedora 31+ openSUSE CentOS 9 Stream CentOS 8 CentOS 8 Stream CentOS 7 Debian 10 Debian 11 Debian 12 Rasbian 10 Rasbian 11 xUbuntu 22.04 xUbuntu 21.10 xUbuntu 20.04 xUbuntu 18.04 ``` To install, choose a supported version for your operating system, and export it as a variable, like so: `export VERSION=1.19` We also save releases as subprojects. If you'd, for instance, like to use `1.24.5` you can set `export VERSION=1.24.5` and `export SUBVERSION=$(echo $VERSION | awk -F'.' '{print $1"."$2}')` Packaging for CRI-O is done best-effort, and is largely driven by requests. If there's a version or operating system that is missing, please . For 1.29 and above, please follow the instructions in the . For 1.28 and earlier, please read our . runc, Clear Containers runtime, or any other OCI compatible runtime iproute iptables Latest version of `runc` is expected to be installed on the system. It is picked up as the default runtime by CRI-O. Fedora, RHEL 7, CentOS and related distributions: ```shell yum install -y \ containers-common \ device-mapper-devel \ git \ glib2-devel \ glibc-devel \ glibc-static \ go \ gpgme-devel \ libassuan-devel \ libgpg-error-devel \ libseccomp-devel \ libselinux-devel \ pkgconfig \ make \ runc ``` Please note: `CentOS 8` (or higher): `pkgconfig` package is replaced by `pkgconf-pkg-config` By default btrfs is not enabled. To add the btrfs support, install the following package: `btrfs-progs-devel` `CentOS 8`: `gpgme-devel` can be installed with the powertools repo. (`yum install -y gpgme-devel --enablerepo=powertools`) `CentOS 9`: `gpgme-devel` can be installed with the CodeReadyBuilder (crb) repo. (`yum install -y gpgme-devel --enablerepo=crb`) It is possible the distribution packaged version of runc is out of date. If you'd like to get the latest and greatest runc, consider using the one found in For RHEL 8 distributions (tested on RHEL 8.5). Make sure you are subscribed to the following repositories: BaseOS/x86_64 Appstream/x86_64 CodeReady Linux Builder for x86_64 ```shell subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms subscription-manager repos --enable=codeready-builder-for-rhel-8-x86_64-rpms ``` Follow if not already subscribed. This requires Go version 1.18 or greater. Follow Install dependencies: ```shell yum install -y \ containers-common \ device-mapper-devel \ git \ make \ glib2-devel \ glibc-devel \ glibc-static \ runc ``` Install go-md2man: ```shell go get github.com/cpuguy83/go-md2man ``` Install dependencies: ```shell yum install -y \ libassuan \ libassuan-devel \ libgpg-error \ libseccomp-devel \ libselinux \ pkgconf-pkg-config \ gpgme-devel \ gcc-go ``` On Debian, Raspbian and Ubuntu distributions, [enable the Kubic project repositories](#apt-based-operating-systems) (for `containers-common` and `cri-o-runc` packages) and install the following packages: ```shell apt update -qq && \ apt install -y \ btrfs-tools \ containers-common \ git \ libassuan-dev \ libdevmapper-dev \ libglib2.0-dev \ libc6-dev \ libgpgme11-dev \ libgpg-error-dev \ libseccomp-dev \ libsystemd-dev \ libbtrfs-dev \ libselinux1-dev \ pkg-config \ go-md2man \ cri-o-runc \ libudev-dev \ software-properties-common \ gcc \ make ``` ```shell apt-get update -qq && apt-get install -y \ libbtrfs-dev \ containers-common \ git \ libassuan-dev \ libdevmapper-dev \

\ libc6-dev \ libgpgme-dev \ libgpg-error-dev \ libseccomp-dev \ libsystemd-dev \ libselinux1-dev \ pkg-config \ go-md2man \ cri-o-runc \ libudev-dev \ software-properties-common \ gcc \ make ``` Caveats and Notes: If using an older release or a long-term support release, be careful to double-check that the version of `runc` is new enough (running `runc --version` should produce `spec: 1.0.0` or greater), or else build your own. Be careful to double-check that the version of golang is new enough, version 1.12.x or higher is required. If needed, newer golang versions are available at . Clone the source code using: ```shell git clone https://github.com/cri-o/cri-o # or your fork cd cri-o ``` Make sure your `CRI-O` and `kubernetes` versions are of matching major versions. For instance, if you want to be compatible with the latest kubernetes release, you'll need to use the latest tagged release of `CRI-O` on branch `release-1.18`. To install with default buildtags using seccomp, use: ```shell make sudo make install ``` Otherwise, if you do not want to build `CRI-O` with seccomp support you can add `BUILDTAGS=""` when running make. ```shell make BUILDTAGS="" sudo make install ``` An is also available to automate the above steps: ``` bash sudo su - mkdir -p ~/.ansible/roles cd ~/.ansible/roles git clone https://github.com/alvistack/ansible-role-crio.git crio cd ~/.ansible/roles/cri_o pip3 install --upgrade --ignore-installed --requirement requirements.txt molecule converge molecule verify ``` `CRI-O` supports optional build tags for compiling support of various features. To add build tags to the make option the `BUILDTAGS` variable must be set. ```shell make BUILDTAGS='seccomp apparmor' ``` | Build Tag | Feature | Dependency | | | - | - | | seccomp | syscall filtering | libseccomp | | selinux | selinux process and mount labeling | libselinux | | apparmor | apparmor profile support | | `CRI-O` manages images with , which uses the following buildtags. <!-- markdownlint-disable MD013 --> | Build Tag | Feature | Dependency | | - | - | - | | containersimageopenpgp | use native golang pgp instead of cgo | | | containersimageostree_stub | disable use of ostree as an image transport | | `CRI-O` also uses for managing container storage. | Build Tag | Feature | Dependency | | -- | -- | | | excludegraphdriverbtrfs | exclude btrfs as a storage option | | | btrfs_noversion | for building btrfs version < 3.16.1 | btrfs | | excludegraphdriverdevicemapper | exclude devicemapper as a storage option | | | libdmnodeferred_remove | don't compile deferred remove with devicemapper | devicemapper | | excludegraphdriveroverlay | exclude overlay as a storage option | | | ostree | build storage using ostree | ostree | <!-- markdownlint-enable MD013 --> It is possible to build a statically linked binary of CRI-O by using the officially provided package and the derivation of it . The builds are completely reproducible and will create a `x86_64`/`amd64` or `aarch64`/`arm64`, `ppc64le` or `s390x` stripped ELF binary for . These binaries are integration tested as well and support the following features: apparmor btrfs device mapper gpgme seccomp selinux To build the binaries locally either [install the nix package manager](https://nixos.org/nix/download.html) or use the `make build-static` target which relies on the nixos/nix container image. The overall build process can take a tremendous amount of CPU time depending on the

The resulting binaries should now be available within: `bin/static/crio` To build the binaries without any prepared container and via the already installed nix package manager, simply run the following command from the root directory of this repository: ```shell nix build -f nix ``` The resulting binaries should be now available in `result/bin`. To build the arm variant of the binaries, just run: ```shell nix build -f nix/default-arm64.nix ``` Similarly, the ppc64le variant of binaries can be built using: ```shell nix build -f nix/default-ppc64le.nix ``` In the same way, the s390x variant of binaries can be built using: ```shell nix build -f nix/default-s390x.nix ``` is a per-container daemon that `CRI-O` uses to monitor container logs and exit information. `conmon` needs to be downloaded with `CRI-O`. running: ```shell git clone https://github.com/containers/conmon cd conmon make sudo make install ``` will download conmon to your $PATH. A proper description of setting up CNI networking is given in the . But the gist is that you need to have some basic network configurations enabled and CNI plugins installed on your system. If you are installing for the first time, generate and install configuration files with: ```shell sudo make install.config ``` Edit `/etc/containers/registries.conf` and verify that the registries option has valid values in it. For example: <!-- markdownlint-disable MD013 --> ```conf [registries.search] registries = ['registry.access.redhat.com', 'registry.fedoraproject.org', 'quay.io', 'docker.io'] [registries.insecure] registries = [] [registries.block] registries = [] ``` <!-- markdownlint-enable MD013 --> For more information about this file see . Users can modify the `log_level` by specifying an overwrite like `/etc/crio/crio.conf.d/01-log-level.conf` to change the verbosity of the logs. Options are fatal, panic, error, warn, info (default), debug and trace. ```conf [crio.runtime] log_level = "info" ``` By default, `CRI-O` uses the following capabilities: ```conf default_capabilities = [ "CHOWN", "DAC_OVERRIDE", "FSETID", "FOWNER", "SETGID", "SETUID", "SETPCAP", "NETBINDSERVICE", "KILL", ] ``` and no sysctls ```conf default_sysctls = [ ] ``` Users can change either default by adding overwrites to `/etc/crio/crio.conf.d`. Running make install will download CRI-O into the folder ```shell /usr/local/bin/crio ``` You can run it manually there, or you can set up a systemd unit file with: ```shell sudo make install.systemd ``` And let systemd take care of running CRI-O: ``` bash sudo systemctl daemon-reload sudo systemctl enable crio sudo systemctl start crio ``` Follow this to quickly get started running simple pods and containers. To run a full cluster, see . To run with kubeadm, see . <!-- markdownlint-disable MD024 --> ```shell sudo zypper update sudo zypper update cri-o ``` ```shell sudo dnf update sudo dnf update cri-o ``` ```shell sudo yum update sudo yum update cri-o ``` If updating to a patch version (for example, ``VERSION=1.8.3`` ), run ```shell apt upgrade cri-o cri-o-runc ``` <!-- markdownlint-enable MD024 --> Otherwise, be sure that the environment variable ```$OS``` is set to the appropriate value from the following table for your operating system. To install on the following operating systems, set the environment variable ```$OS``` to the appropriate value from the following table: | Operating system | $OS | | - | -- | | Debian Unstable | `Debian_Unstable` | | Debian Testing | `Debian_Testing` | | Debian 11 | `Debian_11` | | Debian 10 | `Debian_10` | | Ubuntu 22.04 | `xUbuntu_22.04` | | Ubuntu 21.10 | `xUbuntu_21.10` | | Ubuntu 21.04 | `xUbuntu_21.04` | | Ubuntu 20.10 | `xUbuntu_20.10` | | Ubuntu 20.04 | `xUbuntu_20.04` | | Ubuntu 18.04 | `xUbuntu_18.04` | To upgrade, choose a supported version for your operating system, and export it as a variable, like so: `export VERSION=1.18`, and run the following as root <!-- markdownlint-disable MD013 --> ```shell rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list echo "deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ /"