container_config.json

{
	"metadata": {
		"name": "powertest",
		"attempt": 1
	},
	"image": {
		"image": "docker.io/library/alpine:latest"
	},
	"command": [
		"/bin/sh"
	],
	"args": [],
	"working_dir": "/",
	"envs": [
		{
			"key": "PATH",
			"value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
		},
		{
			"key": "TERM",
			"value": "xterm"
		}
	],
	"privileged": true,
	"log_path": "",
	"stdin": false,
	"stdin_once": false,
	"tty": false,
	"linux": {
		"resources": {
			"cpu_period": 10000,
			"cpu_quota": 20000,
			"cpu_shares": 512,
			"oom_score_adj": 30
		},
		"security_context": {
			"readonly_rootfs": false,
			"selinux_options": {
			    "user": "system_u",
			    "role": "system_r",
			    "type": "svirt_lxc_net_t",
			    "level": "s0:c4,c5"
			},
			"capabilities": {
				"add_capabilities": [
					"setuid",
					"setgid"
				],
				"drop_capabilities": [
				]
			}
		}
	}
}

cri-test.go

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"
	"time"

	"google.golang.org/grpc"
	pb "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
	"k8s.io/kubernetes/pkg/kubelet/util"
)

const (
	RuntimeEndpoint = "unix:///run/containerd/containerd.sock"
)

func main() {

	addr, dialer, err := util.GetAddressAndDialer(RuntimeEndpoint)
	if err != nil {
		fmt.Println("util : ", err)
		os.Exit(1)
	}
	conn, err := grpc.Dial(addr, grpc.WithInsecure(),
		grpc.WithTimeout(time.Duration(100*time.Second)),
		grpc.WithDialer(dialer))

	if err != nil {
		fmt.Printf("failed to connect: %v", err)
		os.Exit(1)
	}

	client := pb.NewRuntimeServiceClient(conn)

	ctx := context.Background()

	version, err := client.Version(ctx, &pb.VersionRequest{})
	if err != nil {
		fmt.Println("Version error : ", err)
		os.Exit(1)
	}
	fmt.Println(version.GetVersion())

	config, err := loadPodSandboxConfig("contrib/sandbox_config.json")
	if err != nil {
		fmt.Printf("Pod creation error: %v", err)
	}

	r, err := client.RunPodSandbox(ctx, &pb.RunPodSandboxRequest{Config: config})
	if err != nil {
		fmt.Printf("Pod run error: %v", err)
	}
	fmt.Printf("Pod Created: ", r.PodSandboxId)

}

func loadPodSandboxConfig(path string) (*pb.PodSandboxConfig, error) {
	f, err := openFile(path)
	if err != nil {
		return nil, err
	}
	defer f.Close()

	var config pb.PodSandboxConfig
	if err := json.NewDecoder(f).Decode(&config); err != nil {
		return nil, err
	}
	return &config, nil
}

func openFile(path string) (*os.File, error) {
	f, err := os.Open(path)
	if err != nil {
		if os.IsNotExist(err) {
			return nil, fmt.Errorf("config at %s not found", path)
		}
		return nil, err
	}
	return f, nil
}

sandbox_config.json

{
	"metadata": {
		"name": "podsandbox1",
		"uid": "powertest-test-crio",
		"namespace": "powertest.test.crio",
		"attempt": 1
	},
	"hostname": "crioctl_host",
	"log_directory": "",
	"dns_config": {
		"searches": [
			"8.8.8.8"
		]
	},
	"port_mappings": [],
	"resources": {
		"cpu": {
			"limits": 3,
			"requests": 2
		},
		"memory": {
			"limits": 50000000,
			"requests": 2000000
		}
	},
	"labels": {
		"group": "test"
	},
	"annotations": {
		"owner": "hmeng",
		"security.alpha.kubernetes.io/sysctls": "kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000",
		"security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" ,
		"security.alpha.kubernetes.io/seccomp/pod": "unconfined"
	},
	"linux": {
		"cgroup_parent": "/Burstable/pod_123-456",
		"security_context": {
			"namespace_options": {
				"host_network": false,
				"host_pid": false,
				"host_ipc": false
			},
			"selinux_options": {
				"user": "system_u",
				"role": "system_r",
				"type": "svirt_lxc_net_t",
				"level": "s0:c4,c5"
			}
		}
	}
}

vendor.conf

k8s.io/api beab4da9671e79815b7876363175af45aa180eb5
k8s.io/apimachinery 6212319467788d635606616d5c6d87ded0321d8c
k8s.io/client-go 33bd23f75b6de861994706a322b0afab824b2171
k8s.io/kubernetes 0caa20c65f147e15f5545862510eb7e81c42b0a3
k8s.io/utils a99a3e11a96751670db62ba77c6d278d1136931e