@@ -89,5 +89,61 @@ containers the same set of permissions as the calling process, preventing errors
8989when privileged containers attempt to get more permissions than given to the
9090caller.
9191
92+ #### Configuration changes
93+
94+ ##### *New* `registry.config_path` for CRI plugin
95+
96+ `registry.config_path` specifies a directory to look for registry hosts
97+ configuration. When resolving an image name during pull operations, the CRI
98+ plugin will look in the `<registry.config_path>/<image hostname>/` directory
99+ for host configuration. An optional `hosts.toml` file in that directory may be
100+ used to configure which hosts will be used for the pull operation as well
101+ host-specific configurations. Updates under that directory do not require
102+ restarting the containerd daemon.
103+
104+ Enable `registry.config_path` in the containerd configuration file.
105+
106+ ```toml
107+ [plugins."io.containerd.grpc.v1.cri".registry]
108+ config_path = "/etc/containerd/certs.d"
109+ ```
110+
111+ Configure registry hosts, such as `/etc/containerd/certs.d/docker.io/hosts.toml`
112+ for any image under the `docker.io` namespace (any image on Docker Hub).
113+
114+ ```
115+ server = "https://registry-1.docker.io" # Exclude this to not use upstream
116+
117+ [host."https://public-mirror.example.com"]
118+ capabilities = ["pull"] # Requires less trust, won't resolve tag to digest from this host
119+ [host."https://docker-mirror.internal"]
120+ capabilities = ["pull", "resolve"]
121+ ca = "docker-mirror.crt" # Or absolute path /etc/containerd/certs.d/docker.io/docker-mirror.crt
122+ ```
123+
124+ If no `hosts.toml` configuration exists in the host directory, it will fallback
125+ to check certificate files based on Docker's certificate file
126+ pattern (".crt" files for CA certificates and ".cert"/".key" files for client
127+ certificates).
128+
129+ ##### Deprecation of `registry.mirrors` and `registry.configs` in CRI plugin
130+
131+ Mirroring and TLS can now be configured using the new `registry.config_path`
132+ option. Existing configurations may be migrated to new host directory
133+ configuration. These fields are only deprecated with no planned removal,
134+ however, these configurations cannot be used while `registry.config_path` is
135+ defined.
136+
137+ ##### Version 1 schema is deprecated
138+
139+ Version 2 of the containerd configuration toml is recommended format and the
140+ default. Starting this version, a deprecation warning will be logged when
141+ version 1 is used.
142+
143+ To check version, see the version value in the containerd toml configuration.
144+
145+ ```toml
146+ version=2
147+ ```
92148
93149See the changelog for complete list of changes"""
0 commit comments