cri-o config

10-crio.conf

[crio.image]
signature_policy = "/etc/crio/policy.json"

[crio.runtime]
default_runtime = "runc"
log_level = "debug"

[crio.runtime.runtimes.crun]
runtime_type = "pod"
runtime_path = "/usr/libexec/crio/crun"
runtime_root = "/run/crun"
monitor_path = "/usr/local/bin/conmonrs"
allowed_annotations = [
    "io.containers.trace-syscall",
]

[crio.runtime.runtimes.runc]
runtime_type = "pod"
runtime_path = "/usr/libexec/crio/runc"
runtime_root = "/run/runc"
monitor_path = "/usr/local/bin/conmonrs"

conmon-rs & CRI-O

conmon does not pass the crun flags to OCI runtimes while conmon-rs does (see here).
By default, CRI-O uses conmon and to switch to conmon-rs follow the steps below.

# download the conmon-rs statically linked binary
curl https://raw.githubusercontent.com/containers/conmon-rs/main/scripts/get | bash
sudo mv conmonrs /usr/libexec/crio/conmonrs
sudo cp 10-crio.conf /etc/crio/crio.conf.d/
sudo systemctl restart crio
# verify that the correct configuration is loaded
sudo crio status config | grep -q 'default_runtime = "runc"'
sudo crio status config | grep -q 'runtime_type = "pod"'

runc...

$ journalctl -xeu crio.service -f --grep conmonrs
Feb 06 10:09:29 dev conmonrs[148521]:  INFO conmonrs::server: 188: Using systemd/journald logger
Feb 06 10:09:29 dev conmonrs[148521]:  INFO conmonrs::server: 191: Set log level to: debug
Feb 06 10:09:29 dev conmonrs[148521]: DEBUG backend: conmonrs::rpc: 78: Got a version request
Feb 06 10:09:29 dev crio[137279]: time="2025-02-06T10:09:29.776381792+02:00" level=debug msg="Running conmonrs with PID: 148521" file="oci/runtime_pod.go:77"
Feb 06 10:09:29 dev conmonrs[148521]: DEBUG backend: conmonrs::rpc: 78: Got a version request
Feb 06 10:09:29 dev crio[137279]: time="2025-02-06T10:09:29.77724418+02:00" level=debug msg="Using conmonrs version: 0.6.6, tag: none, commit: a76f74637d9c0b1ffd6b6d042b25c2cc2bfd99bb, build: 1980-01-01 00:00:00 +00:00, target: x86_64-unknown-linux-gnu, rustc 1.79.0 (129f3b996 2024-06-10) (built from a source tarball), cargo 1.79.0" file="oci/runtime_pod.go:105" id=1d84a8d8-2d26-474f-be11-89711a2a3a0d name=/runtime.v1.RuntimeService/RunPodSandbox

crun...

conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}: conmonrs::streams: 40: Creating new IO streams
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}: conmonrs::rpc: 124: PID file is /run/containers/storage/overlay-containers/78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d/userdata/pidfile
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}: conmonrs::server: 356: Runtime args "--root=/run/runc --systemd-cgroup --root=/run/runc --systemd-cgroup create --bundle /run/containers/storage/overlay-containers/78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d/userdata --pid-file /run/containers/storage/overlay-containers/78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d/userdata/pidfile 78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d"
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise: conmonrs::container_log::cri: 50: Initializing CRI logger in path /var/log/pods/calico-system_calico-node-857b6_29ec4fdd-7a7a-4ff7-8e2f-78bd3b8f3a04/install-cni/0.log
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise: conmonrs::child_reaper: 74: Running: "/usr/libexec/crio/runc" ["--root=/run/runc", "--systemd-cgroup", "--root=/run/runc", "--systemd-cgroup", "create", "--bundle", "/run/containers/storage/overlay-containers/78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d/userdata", "--pid-file", "/run/containers/storage/overlay-containers/78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d/userdata/pidfile", "78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d"]
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise: conmonrs::child_reaper: 99: Running child on PID: 1443556
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise: conmonrs::streams: 62: Start reading from IO streams
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:watch{pid=1443572}: conmonrs::child_reaper: 351: Running task
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:watch{pid=1443572}:cgroup_handling:oom_handling_cgroup_v2{pid=1443572}: conmonrs::oom_watcher: 451: Using cgroup path: /proc/1443572/cgroup
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:watch{pid=1443572}:wait_for_exit_code: conmonrs::child_reaper: 445: Waiting for exit code
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:watch{pid=1443572}:cgroup_handling: conmonrs::oom_watcher: 213: Setup cgroup v2 handling path="/sys/fs/cgroup/kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-pod29ec4fdd_7a7a_4ff7_8e2f_78bd3b8f3a04.slice/crio-78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d.scope/memory.events"
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:stderr: conmonrs::container_io: 261: Read 92 bytes
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:stderr: conmonrs::container_io: 261: Read 136 bytes
Feb 05 11:37:22 dev conmonrs[1443271]: DEBUG backend:create_container{container_id="78c8dfbada98fbc60371b34408b5056a3ea2877bab44d71f259d1f8c7424eb5d" uuid="abf525eb-09d5-4aa0-bcb8-36f2c797c302"}:promise:stderr: conmonrs::container_io: 261: Read 102 bytes
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend: conmonrs::rpc: 78: Got a version request
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend: conmonrs::rpc: 78: Got a version request
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}: conmonrs::rpc: 115: Got a create container request
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}: conmonrs::streams: 40: Creating new IO streams
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}: conmonrs::rpc: 124: PID file is /run/containers/storage/overlay-containers/cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070/userdata/pidfile
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}: conmonrs::server: 356: Runtime args "--root=/run/runc --systemd-cgroup --root=/run/runc --systemd-cgroup create --bundle /run/containers/storage/overlay-containers/cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070/userdata --pid-file /run/containers/storage/overlay-containers/cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070/userdata/pidfile cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070"
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise: conmonrs::container_log::cri: 50: Initializing CRI logger in path /var/log/pods/kube-system_coredns-668d6bf9bc-zxjh2_28262fd8-b59b-4e32-945f-46b00013997c/coredns/0.log
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise: conmonrs::child_reaper: 74: Running: "/usr/libexec/crio/runc" ["--root=/run/runc", "--systemd-cgroup", "--root=/run/runc", "--systemd-cgroup", "create", "--bundle", "/run/containers/storage/overlay-containers/cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070/userdata", "--pid-file", "/run/containers/storage/overlay-containers/cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070/userdata/pidfile", "cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070"]
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise: conmonrs::child_reaper: 99: Running child on PID: 1443804
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise: conmonrs::streams: 62: Start reading from IO streams
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise:watch{pid=1443815}: conmonrs::child_reaper: 351: Running task
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise:watch{pid=1443815}:cgroup_handling:oom_handling_cgroup_v2{pid=1443815}: conmonrs::oom_watcher: 451: Using cgroup path: /proc/1443815/cgroup
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise:watch{pid=1443815}:wait_for_exit_code: conmonrs::child_reaper: 445: Waiting for exit code
Feb 05 11:37:23 dev conmonrs[1443763]: DEBUG backend:create_container{container_id="cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070" uuid="172fe138-f21a-4760-a53b-636a644a7129"}:promise:watch{pid=1443815}:cgroup_handling: conmonrs::oom_watcher: 213: Setup cgroup v2 handling path="/sys/fs/cgroup/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod28262fd8_b59b_4e32_945f_46b00013997c.slice/crio-cee1ab7ac6bfadda61f193ace55e267432c85a6e3b1dfe8e0eaba475c9b9d070.scope/memory.events"