crio-cor.conf

# The "crio" table contains all of the server options.
[crio]

# root is a path to the "root directory". CRI-O stores all of its data,
# including container images, in this directory.
root = "/var/lib/ocid"

# run is a path to the "run directory". CRI-O stores all of its state
# in this directory.
runroot = "/var/run/containers"

# storage_driver select which storage driver is used to manage storage
# of images and containers.
storage_driver = ""

# storage_option is used to pass an option to the storage driver.
storage_option = [
]

# The "crio.api" table contains settings for the kubelet/gRPC
# interface (which is also used by ocic).
[crio.api]

# listen is the path to the AF_LOCAL socket on which crio will listen.
listen = "/var/run/crio.sock"

# The "crio.runtime" table contains settings pertaining to the OCI
# runtime used and options for how to set up and manage the OCI runtime.
[crio.runtime]

# runtime is a path to the OCI runtime which crio will be using.
runtime = "/usr/bin/cc-oci-runtime.sh"

# runtime_host_privileged is a path to the OCI runtime which crio
# will be using for host privileged operations.
# If this string is empty, crio will not try to use the "runtime"
# for all operations.
runtime_host_privileged = "/usr/local/sbin/runc"

# conmon is the path to conmon binary, used for managing the runtime.
conmon = "/usr/local/libexec/crio/conmon"

# conmon_env is the environment variable list for conmon process,
# used for passing necessary environment variable to conmon or runtime.
conmon_env = [
	"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
]

# selinux indicates whether or not SELinux will be used for pod
# separation on the host. If you enable this flag, SELinux must be running
# on the host.
selinux = false

# seccomp_profile is the seccomp json profile path which is used as the
# default for the runtime.
seccomp_profile = "/etc/crio/seccomp.json"

# apparmor_profile is the apparmor profile name which is used as the
# default for the runtime.
apparmor_profile = "crio-default"

# cgroup_manager is the cgroup management implementation to be used
# for the runtime.
cgroup_manager = "cgroupfs"

# The "crio.image" table contains settings pertaining to the
# management of OCI images.
[crio.image]

# default_transport is the prefix we try prepending to an image name if the
# image name as we receive it can't be parsed as a valid source reference
default_transport = "docker://"

# pause_image is the image which we use to instantiate infra containers.
pause_image = "kubernetes/pause"

# pause_command is the command to run in a pause_image to have a container just
# sit there.  If the image contains the necessary information, this value need
# not be specified.
pause_command = "/pause"

# signature_policy is the name of the file which decides what sort of policy we
# use when deciding whether or not to trust an image that we've pulled.
# Outside of testing situations, it is strongly advised that this be left
# unspecified so that the default system-wide policy will be used.
signature_policy = ""

# The "crio.network" table contains settings pertaining to the
# management of CNI plugins.
[crio.network]

# network_dir is is where CNI network configuration
# files are stored.
network_dir = "/etc/cni/net.d/"

# plugin_dir is is where CNI plugin binaries are stored.
plugin_dir = "/opt/cni/bin/"