Question

A worker node's kubelet is running, but you suspect containers are failing at the runtime level. The node uses containerd as its CRI. You need to list all running containers and inspect a specific container's status directly at the runtime layer, bypassing the Kubernetes API. Which tool and configuration is the correct approach?

Accepted Answer

Use crictl with the runtime endpoint set to unix:///run/containerd/containerd.sock (e.g., via /etc/crictl.yaml or --runtime-endpoint) to run 'crictl ps' and 'crictl inspect'.

Answer

Use 'docker ps' and 'docker inspect' since Kubernetes always manages containers through the Docker daemon socket.

Answer

Run 'kubectl get pods -o wide' on the node, since kubectl communicates directly with the container runtime when run locally.

Answer

Use 'ctr --namespace k8s.io containers list' after setting the CRI endpoint to unix:///var/run/crio/crio.sock.