set default config_path in plugin init

akhilerm · samuelkarp · commit d58df074a521 · 2026-03-06T10:03:58.000-08:00
move setting the config_path from default image config to plugin init.
only set the default value when both mirrors and config_path are empty,
in all other cases retain the existing behaviour

Signed-off-by: Akhil Mohan &lt;akhilerm@gmail.com&gt;
diff --git a/internal/cri/config/config_unix.go b/internal/cri/config/config_unix.go
@@ -32,9 +32,7 @@ func DefaultImageConfig() ImageConfig {
 		Snapshotter:                defaults.DefaultSnapshotter,
 		DisableSnapshotAnnotations: true,
 		MaxConcurrentDownloads:     3,
-		Registry: Registry{
-			ConfigPath: "/etc/containerd/certs.d:/etc/docker/certs.d",
-		},
+		Registry:                   Registry{},
 		ImageDecryption: ImageDecryption{
 			KeyModel: KeyModelNode,
 		},
diff --git a/plugins/cri/images/plugin.go b/plugins/cri/images/plugin.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"path/filepath"
-	"runtime"
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/metadata"
@@ -61,6 +60,14 @@ func init() {
 			}
 			mdb := m.(*metadata.DB)
 
+			// only set the default value of config path, if both mirrors and
+			// config path are empty.
+			// This also makes sure that if the loaded config already contains both config path and mirrors
+			// the validation will fail.
+			if config.Registry.ConfigPath == "" && len(config.Registry.Mirrors) == 0 {
+				config.Registry.ConfigPath = "/etc/containerd/certs.d:/etc/docker/certs.d"
+			}
+
 			if warnings, err := criconfig.ValidateImageConfig(ic.Context, &config); err != nil {
 				return nil, fmt.Errorf("invalid cri image config: %w", err)
 			} else if len(warnings) > 0 {
@@ -210,18 +217,6 @@ func migrateConfig(dst, src map[string]interface{}) {
 			dst[key] = val
 		}
 	}
-	if runtime.GOOS == "linux" {
-		if value, ok := dst["registry"]; ok {
-			regMap := value.(map[string]any)
-			if configPath, ok := regMap["config_path"]; ok {
-				if configPath == "" {
-					// Fill in default from config_unix.go (DefaultImageConfig)
-					regMap["config_path"] = "/etc/containerd/certs.d:/etc/docker/certs.d"
-				}
-			}
-			dst["registry"] = regMap
-		}
-	}
 
 	containerdConf, ok := src["containerd"]
 	if !ok {
