ctr - Man Page

Lists containerd plugins

--detailed, -d: Print detailed information about each plugin

--quiet, -q: Print only the plugin ids

Display runtime info

--runc-binary="": Specify runc-compatible binary

--runc-root="": Specify runc-compatible root

--runc-systemd-cgroup: Start runc with systemd cgroup manager

--runtime="": Runtime name or absolute path to runtime binary (default: "io.containerd.runc.v2")

--runtime-config-path="": Optional runtime config path

Create container

--allow-new-privs: Turn off OCI spec's NoNewPrivileges feature flag

--annotation="": Specify additional OCI annotations (e.g. foo=bar)

--apparmor-default-profile="": Enable AppArmor with the default profile with the specified name, e.g. "cri-containerd.apparmor.d"

--apparmor-profile="": Enable AppArmor with an existing custom profile

--blockio-class="": Name of the blockio class to associate the container with

--blockio-config-file="": File path to blockio class definitions. By default class definitions are not loaded.

--cap-add="": Add Linux capabilities (Set capabilities with 'CAP_' prefix)

--cap-drop="": Drop Linux capabilities (Set capabilities with 'CAP_' prefix)

--config, -c="": Path to the runtime-specific spec config file

--cpu-period="": Limit CPU CFS period (default: 0)

--cpu-quota="": Limit CPU CFS quota (default: -1)

--cwd="": Specify the working directory of the process

--device="": File path to a device to add to the container; or a path to a directory tree of devices to add to the container

--env="": Specify additional container environment variables (e.g. FOO=bar)

--env-file="": Specify additional container environment variables in a file(e.g. FOO=bar, one per line)

--gpus="": Add gpus to the container

--hostname="": Set the container's host name

--label="": Specify additional labels (e.g. foo=bar)

--memory-limit="": Memory limit (in bytes) for the container (default: 0)

--mount="": Specify additional container mount (e.g. type=bind,src=/tmp,dst=/host,options=rbind:ro)

--net-host: Enable host networking for the container

--no-pivot: Disable use of pivot-root (linux only)

--pid-file="": File path to write the task's pid

--privileged: Run privileged container

--rdt-class="": Name of the RDT class to associate the container with. Specifies a Class of Service (CLOS) for cache and memory bandwidth management.

--read-only: Set the containers filesystem as readonly

--rootfs: Use custom rootfs that is not managed by containerd snapshotter

--rootfs-propagation="": Set the propagation of the container rootfs

--runc-binary="": Specify runc-compatible binary

--runc-root="": Specify runc-compatible root

--runc-systemd-cgroup: Start runc with systemd cgroup manager

--runtime="": Runtime name or absolute path to runtime binary (default: "io.containerd.runc.v2")

--runtime-config-path="": Optional runtime config path

--sandbox="": Create the container in the given sandbox

--seccomp: Enable the default seccomp profile

--seccomp-profile="": File path to custom seccomp profile. seccomp must be set to true, before using seccomp-profile

--snapshotter="": Snapshotter name. Empty value stands for the default value.

--snapshotter-label="": Labels added to the new snapshot for this container.

--tty, -t: Allocate a TTY for the container

--user, -u="": Username or user id, group optional (format: [:])

--with-ns="": Specify existing Linux namespaces to join at container runtime (format ':')

Delete one or more existing containers

--keep-snapshot: Do not clean up snapshot with container

Get info about a container

--spec: Only display the spec

List containers

--quiet, -q: Print only the container id

Set and clear labels for a container

Checkpoint a container

--image: Include the image in the checkpoint

--rw: Include the rw layer in the checkpoint

--task: Checkpoint container task

Restore a container from checkpoint

--live: Restore the runtime and memory data from the checkpoint

--rw: Restore the rw layer from the checkpoint

Display active transfers

--root="": Path to content store root (default: "/tmp/content")

--timeout, -t="": Total timeout for fetch (default: 0s)

Permanently delete one or more blobs

Edit a blob and return a new digest

--editor="": Select editor (vim, emacs, etc.)

--validate="": Validate the result against a format (json, mediatype, etc.)

Fetch all content for an image into containerd

--all-platforms: Pull content from all platforms

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--label="": Labels to attach to the image

--metadata-only: Pull all metadata including manifests and configs

--plain-http: Allow connections using plain HTTP

--platform="": Pull content from a specific platform

--refresh="": Refresh token for authorization server

--skip-metadata: Skips metadata for unused platforms (Image may be unable to be pushed without metadata)

--skip-verify, -k: Skip SSL certificate validation

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Retrieve objects from a remote

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--plain-http: Allow connections using plain HTTP

--refresh="": Refresh token for authorization server

--skip-verify, -k: Skip SSL certificate validation

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Retrieve blobs from a remote

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--media-type="": Specify target mediatype for request header

--plain-http: Allow connections using plain HTTP

--refresh="": Refresh token for authorization server

--skip-verify, -k: Skip SSL certificate validation

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Get the data for an object

Accept content into the store

--expected-digest="": Verify content against expected digest

--expected-size="": Validate against provided size (default: 0)

List all blobs in the store

--quiet, -q: Print only the blob digest

Push an object to a remote

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--plain-http: Allow connections using plain HTTP

--refresh="": Refresh token for authorization server

--skip-verify, -k: Skip SSL certificate validation

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Add labels to content

Prunes content from the content store

Prunes preference labels from the content store (layers only by default)

--async: Allow garbage collection to cleanup asynchronously

--dry: Just show updates without applying (enables debug logging)

Check existing images to ensure all content is available locally

--quiet, -q: Print only the ready image refs (fully downloaded and unpacked)

--snapshotter="": Snapshotter name. Empty value stands for the default value.

Export images

--all-platforms: Exports content from all platforms

--local: Run export locally rather than through transfer API

--platform="": Pull content from a specific platform

--skip-manifest-json: Do not add Docker compatible manifest.json to archive

--skip-non-distributable: Do not add non-distributable blobs such as Windows layers to archive

Import images

--all-platforms: Imports content for all platforms, false by default

--base-name="": Base image name for added images, when provided only images with this name prefix are imported

--compress-blobs: Compress uncompressed blobs when creating manifest (Docker format only)

--digests: Whether to create digest images (default: false)

--discard-unpacked-layers: Allow the garbage collector to clean layers up from the content store after unpacking, cannot be used with --no-unpack, false by default

--index-name="": Image name to keep index as, by default index is discarded

--label="": Labels to attach to the image

--local: Run import locally rather than through transfer API

--no-unpack: Skip unpacking the images, cannot be used with --discard-unpacked-layers, false by default

--platform="": Imports content for specific platform

--skip-digest-for-named: Skip applying --digests option to images named in the importing tar (use it in conjunction with --digests)

--snapshotter="": Snapshotter name. Empty value stands for the default value.

inspect an image

--content: Show JSON content

List images known to containerd

--quiet, -q: Print only the image refs

Mount an image to a target path

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--label="": Labels to attach to the image

--plain-http: Allow connections using plain HTTP

--platform="": Mount the image for the specified platform (default: "linux/amd64")

--refresh="": Refresh token for authorization server

--rw: Enable write support on the mount

--skip-verify, -k: Skip SSL certificate validation

--snapshotter="": Snapshotter name. Empty value stands for the default value.

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Unmount the image from the target

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--label="": Labels to attach to the image

--plain-http: Allow connections using plain HTTP

--refresh="": Refresh token for authorization server

--rm: Remove the snapshot after a successful unmount

--skip-verify, -k: Skip SSL certificate validation

--snapshotter="": Snapshotter name. Empty value stands for the default value.

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Pull an image from a remote

--all-platforms: Pull content and metadata from all platforms

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--label="": Labels to attach to the image

--local: Fetch content from local client rather than using transfer service

--max-concurrent-downloads="": Set the max concurrent downloads for each pull (default: 0)

--plain-http: Allow connections using plain HTTP

--platform="": Pull content from a specific platform

--print-chainid: Print the resulting image's chain ID

--refresh="": Refresh token for authorization server

--skip-metadata: Skips metadata for unused platforms (Image may be unable to be pushed without metadata)

--skip-verify, -k: Skip SSL certificate validation

--snapshotter="": Snapshotter name. Empty value stands for the default value.

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Push an image to a remote

--allow-non-distributable-blobs: Allow pushing blobs that are marked as non-distributable

--hosts-dir="": Custom hosts configuration directory

--http-dump: Dump all HTTP request/responses when interacting with container registry

--http-trace: Enable HTTP tracing for registry interactions

--local: Push content from local client rather than using transfer service

--manifest="": Digest of manifest

--manifest-type="": Media type of manifest digest (default: "application/vnd.oci.image.manifest.v1+json")

--max-concurrent-uploaded-layers="": Set the max concurrent uploaded layers for each push (default: 0)

--plain-http: Allow connections using plain HTTP

--platform="": Push content from a specific platform

--refresh="": Refresh token for authorization server

--skip-verify, -k: Skip SSL certificate validation

--tlscacert="": Path to TLS root CA

--tlscert="": Path to TLS client certificate

--tlskey="": Path to TLS client key

--user, -u="": User[:password] Registry user and password

Remove unused images

--all: Remove all unused images, not just dangling ones (if all is not specified no images will be pruned)

Remove one or more images by reference

--sync: Synchronously remove image and all associated resources

Tag an image

--force: Force target_ref to be created, regardless if it already exists

--local: Run tag locally rather than through transfer API

--skip-reference-check: Skip the strict check for reference names

Set and clear labels for an image

--replace-all, -r: Replace all labels

Convert an image

--all-platforms: Exports content from all platforms

--oci: Convert Docker media types to OCI media types

--platform="": Pull content from a specific platform

--uncompress: Convert tar.gz layers to uncompressed tar layers

Display usage of snapshots for a given image ref

--snapshotter="": Snapshotter name. Empty value stands for the default value.

List all active leases

--quiet, -q: Print only the blob digest

Create lease

--expires, -x="": Expiration of lease (0 value will not expire) (default: 24h0m0s)

--id="": Set the id for the lease, will be generated by default

Delete a lease

--sync: Synchronously remove leases and all unreferenced resources

Create a new namespace

List namespaces

--quiet, -q: Print only the namespace name

Remove one or more namespaces

--cgroup, -c: Delete the namespace's cgroup

Set and clear labels for a namespace

Goroutine blocking profile

--debug="": Debug pprof args (default: 0)

Dump goroutine stack dump

--debug="": Debug pprof args (default: 2)

Dump heap profile

--debug="": Debug pprof args (default: 0)

CPU profile

--debug="": Debug pprof args (default: 0)

--seconds, -s="": Duration for collection (seconds) (default: 30s)

Goroutine thread creating profile

--debug="": Debug pprof args (default: 0)

Collect execution trace

--debug="": Debug pprof args (default: 0)

--seconds, -s="": Trace time (seconds) (default: 5s)

Commit an active snapshot into the provided name

Get the diff of two snapshots. the default second snapshot is the first snapshot's parent.

--keep: Keep diff content. up to creator to delete it.

--label="": Labels to attach to the image

--media-type="": Media type to use for creating diff (default: "application/vnd.oci.image.layer.v1.tar+gzip")

--ref="": Content upload reference to use

Get info about a snapshot

List snapshots

Mount gets mount commands for the snapshots

Prepare a snapshot from a committed snapshot

--mounts: Print out snapshot mounts as JSON

--target, -t="": Mount target path, will print mount, if provided

Remove snapshots

Add labels to content

Display tree view of snapshot branches

Unpack applies layers from a manifest to a snapshot

--snapshotter="": Snapshotter name. Empty value stands for the default value.

Usage snapshots

-b: Display size in bytes

Create a read-only snapshot from a committed snapshot

--mounts: Print out snapshot mounts as JSON

--target, -t="": Mount target path, will print mount, if provided

Attach to the IO of a running container

Checkpoint a container

--exit: Stop the container after the checkpoint

--image-path="": Path to criu image files

--work-path="": Path to criu work files and logs

Delete one or more tasks

--exec-id="": Process ID to kill

--force, -f: Force delete task process

Execute additional processes in an existing container

--cwd="": Working directory of the new process

--detach, -d: Detach from the task after it has started execution

--exec-id="": Exec specific id for the process

--fifo-dir="": Directory used for storing IO FIFOs

--log-uri="": Log uri for custom shim logging

--tty, -t: Allocate a TTY for the container

--user="": User id or name

List tasks

--quiet, -q: Print only the task id

Signal a container (default: SIGTERM)

--all, -a: Send signal to all processes inside the container

--exec-id="": Process ID to kill

--signal, -s="": Signal to send to the container

Get a single data point of metrics for a task with the built-in Linux runtime

--format="": "table" or "json" (default: "table")

Pause an existing container

List processes for container

Resume a paused container

Start a container that has been created

--detach, -d: Detach from the task after it has started execution

--fifo-dir="": Directory used for storing IO FIFOs

--log-uri="": Log uri

--no-pivot: Disable use of pivot-root (linux only)

--null-io: Send all IO to /dev/null

--pid-file="": File path to write the task's pid

See the output of the default OCI spec

--platform="": Platform of the spec to print (Examples: 'linux/arm64', 'windows/amd64')

Run a new sandbox

--runtime="": Runtime name (default: "io.containerd.runc.v2")

List sandboxes

--filters="": The list of filters to apply when querying sandboxes from the store

Remove sandboxes

--force, -f: Ignore shutdown errors when removing sandbox

Print warnings for deprecations

--format="": output format to use (Examples: 'default', 'json')

Delete a container with a task

Exec a new process in the task's container

--attach, -a: Stay attached to the container and open the fifos

--cwd="": Current working directory

--env, -e="": Add environment vars

--spec="": Runtime spec

--stderr="": Specify the path to the stderr fifo

--stdin="": Specify the path to the stdin fifo

--stdout="": Specify the path to the stdout fifo

--tty, -t: Enable tty support

Start a container with a task

Get the state of all main process of the task

--api-version="": shim API version {2,3} (default: 3)

--task-id, -t="": task ID

Provide golang pprof outputs for containerd-shim

Goroutine blocking profile

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 0)

Print goroutine stack dump

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 2)

Dump heap profile

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 0)

CPU profile

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 0)

--seconds, -s="": Duration for collection (seconds) (default: 30s)

Goroutine thread creating profile

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 0)

Collect execution trace

--debug="": Output format, value = 0: binary, value > 0: plaintext (default: 0)

--seconds, -s="": Trace time (seconds) (default: 5s)