Use containerd as the Kubernetes node runtime, while keeping Docker for local image development if you want. Kubernetes nodes need a runtime that implements the Container Runtime Interface (CRI). Kubernetes removed its built-in Docker shim in version 1.24, so a current cluster should connect kubelet directly to a CRI-compatible runtime such as containerd. This change affects the node’s runtime connection—not whether Docker can remain installed on your workstation.
The exact commands depend on the lab’s Kubernetes release, Linux distribution and node topology. The sequence below follows Kubernetes’ documented migration model; verify each package name, service name, configuration file and socket path against your environment before running it.
Why use containerd instead of Docker for Kubernetes?
Docker Engine and containerd are related but occupy different layers. Docker Engine provides a developer-facing experience for building, running and distributing containers. Containerd is a focused container runtime that manages images, snapshots and running containers. Kubernetes’ kubelet communicates with a node runtime through CRI.
Older Kubernetes releases used an in-tree component called dockershim to translate kubelet’s CRI requests for Docker Engine. Dockershim was removed in Kubernetes v1.24. A CRI-compatible runtime such as containerd can serve kubelet without that Docker-specific integration. Kubernetes documents the runtime requirement on its Container Runtimes page and explains the removal in the Dockershim Removal FAQ.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
Choosing containerd for a Kubernetes node therefore does not mean Docker has disappeared from local development. The FAQ states: “If you use Docker on your own PC to develop or test containers: nothing changes.” That sentence is from the Kubernetes document, not a statement attributed to an individual.
Docker Engine and containerd: what changes in the lab?
| Concern | Docker Engine | containerd |
|---|---|---|
| Role on a Kubernetes node | Requires an adapter such as separately maintained cri-dockerd in a post-dockershim cluster. |
Can provide the CRI runtime endpoint used directly by kubelet. |
| Kubelet interface | Not directly usable through the removed in-tree dockershim. | CRI socket configured for the containerd service. |
| Developer CLI | docker commands build and manage Docker Engine containers. |
nerdctl supplies a Docker-like interface; ctr is a lower-level debugging utility and is not Docker CLI-compatible. |
| Managing Kubernetes workloads | Docker commands do not replace Kubernetes workload management. | Use the Kubernetes API for Pods, Deployments and Services rather than manually changing runtime state. |
| Image availability | Images built locally are initially in Docker’s image store. | The node must be able to pull the image into containerd’s store, commonly from a registry, unless you deliberately import it using a supported workflow. |
These distinctions are why a Docker-built image may work in a local Docker test yet fail when a Kubernetes node using containerd tries to start it: the node runtime needs access to that image in its own store or through a registry.
Can I still use Docker if Kubernetes uses containerd?
Yes. You can keep Docker Desktop or Docker Engine on your development machine to build and test images. Push the resulting image to a registry that the cluster can reach, then reference that image in the Pod specification. For a private registry, configure the cluster’s image-pull credentials according to the registry and Kubernetes version.
Do not use docker ps to inspect Pods running through containerd. Docker talks to Docker Engine’s state, while Kubernetes workloads are controlled by the Kubernetes API and run in the node runtime selected by kubelet.
What replaces docker ps on a containerd node?
For Kubernetes workloads
Use Kubernetes commands first. For example, kubectl get pods -A -o wide shows Pods across namespaces, and kubectl describe pod POD_NAME -n NAMESPACE exposes scheduling, image and event details. This is the supported control plane view of the workload.
For containerd-level inspection
nerdctl is designed as a Docker-like CLI over containerd. Its exact namespace and privilege requirements depend on how containerd is configured; Kubernetes-managed objects commonly reside in the k8s.io namespace, so an environment may require an explicit namespace option.
Rank #4
ctr is intended for containerd debugging. It does not promise Docker CLI compatibility, so do not assume that a Docker command, flag or output format will work unchanged. The nerdctl FAQ explains this distinction.
Safe migration sequence from Docker Engine to containerd
The official migration guide presents a sequence rather than a universal copy-and-paste script. Package names, service units, configuration locations, cgroup settings and CRI socket paths vary by operating system and release.
- Confirm the environment. Record the Kubernetes version, operating system, architecture, node role and current runtime. Confirm that the installed containerd package includes a working CRI implementation and that your cluster’s chosen cgroup configuration is supported.
- Drain the node. Move ordinary workloads away with the maintenance procedure appropriate to your cluster. Respect PodDisruptionBudgets and handle DaemonSets or control-plane workloads according to the lab’s topology. Do not begin by abruptly stopping a production node.
- Stop node services. The documented example stops kubelet and Docker before changing the runtime. Use the service manager and unit names present on your operating system.
- Install and configure containerd. Install a version supported by the Kubernetes release. Generate or create the distribution-appropriate configuration, review its CRI and cgroup settings, and enable the containerd service. The guide’s example uses a default configuration and then restarts containerd; that is a starting point, not proof that every distribution’s defaults are suitable.
- Point kubelet at containerd. Change the kubelet runtime endpoint to the containerd CRI socket. The migration example uses
unix:///run/containerd/containerd.sock; treat that path as an example and verify the actual socket on your host. Ensure there is only one intended runtime endpoint in the kubelet configuration. - Restart and inspect. Restart containerd and kubelet in the order required by your distribution. Check service logs, then inspect the node with
kubectl get nodesandkubectl describe node NODE_NAME. A healthy node should return toReadywithout new runtime or image-pull errors. - Test a representative workload. Deploy or restart a small, known-good workload and verify scheduling, image retrieval, readiness, networking and logs through Kubernetes. Check that the image is available to containerd rather than only to Docker’s local store.
- Remove Docker only if appropriate. Once the node is verified and no required tooling depends on Docker Engine, remove it using the platform’s documented package procedure. The migration guide warns that broad Docker purge commands can also risk removing containerd; do not copy an unconditional uninstall command without checking its package dependencies.
- Uncordon the node. Return the node to service only after runtime health and workload behavior are confirmed.
Common failure modes and how to diagnose them
The node stays NotReady
- Check kubelet logs for a missing or invalid CRI endpoint.
- Verify that containerd is running and that the configured socket exists and has the expected permissions.
- Confirm that the containerd CRI plugin is enabled and compatible with the Kubernetes version.
Pods report image-pull errors
- Confirm the image reference, registry reachability and credentials.
- Remember that a Docker-local image is not automatically present in containerd’s image store.
- Use a registry-based workflow or an environment-supported image import, then recreate or restart the workload as needed.
Docker commands show nothing useful
This normally means Docker is inspecting a different runtime. Use kubectl for Kubernetes objects and nerdctl or ctr only for containerd-level inspection, with the correct privileges and namespace.
Runtime migration breaks cgroups or networking
Compare containerd, kubelet and operating-system cgroup settings, then review the release-specific Kubernetes runtime documentation. Also verify that the node’s CNI configuration and required system services were not altered during package installation.
Does a Docker-built image work with containerd?
Usually, the image format itself is not the obstacle: containerd can run standard OCI and Docker-compatible images. The practical issue is distribution. A Docker build places the image in Docker Engine’s local store. A separate Kubernetes node using containerd cannot see that store unless the image is pushed to a reachable registry or imported through a workflow supported by the lab and runtime.
For repeatable labs, tagging the image with a registry-qualified name, pushing it, and using that exact reference in the Kubernetes manifest avoids ambiguity. If the cluster uses a private registry, supply the required pull secret and confirm that every node can resolve and reach the registry.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
What this lab should demonstrate
- Kubelet communicates with a CRI-compatible runtime, not with Docker’s CLI.
- Containerd can replace Docker Engine as the Kubernetes node runtime after dockershim’s removal in Kubernetes v1.24.
- Docker remains a valid local build and test tool.
- Kubernetes API commands are the authoritative way to manage workloads.
nerdctlis the Docker-like containerd CLI, whilectris a debugging tool with different semantics.- Runtime migration is a node-maintenance operation: drain, reconfigure, verify, then return the node to service.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
