Description
When the config.toml version 2 with [plugins."io.containerd.grpc.v1.cri".registry.mirrors] is used with containerd 2.2.0, the migrated config has both config_path and mirrors present, which causes the CRI plugin to error out and not load
WARN[2025-12-02T09:14:18.399047608+05:30] failed to load plugin error="unable to load CRI image service plugin dependency: invalid cri image config: `mirrors` cannot be set when `config_path` is provided" id=io.containerd.podsandbox.controller.v1.podsandbox type=io.containerd.podsandbox.controller.v1
Steps to reproduce the issue
- Use the below config.toml
version = 2
root = "/var/lib/containerd"
state = "/run/containerd"
[grpc]
address = "/run/containerd/containerd.sock"
[plugins."io.containerd.grpc.v1.cri"]
[plugins."io.containerd.grpc.v1.cri".registry]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
endpoint = ["https://registry-1.docker.io"]
- Start containerd 2.2.0 with this config and the CRI plugin will fail to load.
- When using
containerd config migrate with the above config.toml, the generated config has both config_path and registry.mirrors present
version = 3
root = '/var/lib/containerd'
state = '/run/containerd'
[plugins]
[plugins.'io.containerd.cri.v1.images']
[plugins.'io.containerd.cri.v1.images'.pinned_images]
sandbox = 'registry.k8s.io/pause:3.10.1'
[plugins.'io.containerd.cri.v1.images'.registry]
config_path = '/etc/containerd/certs.d:/etc/docker/certs.d'
[plugins.'io.containerd.cri.v1.images'.registry.mirrors]
[plugins.'io.containerd.cri.v1.images'.registry.mirrors.'docker.io']
endpoint = ['https://registry-1.docker.io']Describe the results you received and expected
The config_path should not be set as part of migration when registry.mirrors is already present and CRI plugin should load succesfuly.
What version of containerd are you using?
containerd github.com/containerd/containerd/v2 v2.2.0 1c4457e00facac03ce1d75f7b6777a7a851e5c41
Any other relevant information
The issue is present in main branch also, and was introduced as part of #6488
Show configuration if it is related to CRI plugin.
version = 2
root = "/var/lib/containerd"
state = "/run/containerd"
[grpc]
address = "/run/containerd/containerd.sock"
[plugins."io.containerd.grpc.v1.cri"]
[plugins."io.containerd.grpc.v1.cri".registry]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
endpoint = ["https://registry-1.docker.io"]
Description
When the config.toml version 2 with
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]is used with containerd 2.2.0, the migrated config has bothconfig_pathandmirrorspresent, which causes the CRI plugin to error out and not loadSteps to reproduce the issue
containerd config migratewith the above config.toml, the generated config has bothconfig_pathandregistry.mirrorspresentDescribe the results you received and expected
The config_path should not be set as part of migration when
registry.mirrorsis already present and CRI plugin should load succesfuly.What version of containerd are you using?
containerd github.com/containerd/containerd/v2 v2.2.0 1c4457e00facac03ce1d75f7b6777a7a851e5c41Any other relevant information
The issue is present in main branch also, and was introduced as part of #6488
Show configuration if it is related to CRI plugin.