All Products
Search

This Product

    Container Service for Kubernetes:Customize containerd parameters for a node pool

    Document Center

    Container Service for Kubernetes:Customize containerd parameters for a node pool

    Last Updated:Jun 25, 2026

    If the default containerd configuration is insufficient for your workloads, you can customize containerd parameters for a node pool. For example, you can configure multiple registry mirrors for a specific image registry or configure the system to skip certificate validation for an image registry.

    Limitations

    This feature is available only for node pools that use containerd 1.6.20 or later as the container runtime. If your node pool uses an earlier version, you must upgrade it.

    Precautions

    • Custom containerd settings apply to nodes in batches. These changes take effect immediately on existing nodes and are automatically applied to new nodes.

    • Do not modify the supported customizable containerd parameters from the command line. Container Service for Kubernetes (ACK) blocks these changes. You must revert any such modifications.

    • The system automatically corrects non-standard syntax when applying custom containerd settings.

    Supported customizable containerd parameters

    Custom container runtime configuration

    Parameter

    Note

    Type

    Value

    max_concurrent_downloads

    The maximum number of concurrent image layer downloads. Increasing this value can accelerate pulls for multi-layer images but also increases network and I/O load.

    Int

    • Valid range: [1, 20]

    • Default value: Depends on the containerd version.

      • containerd 2.x and later: 3.

      • containerd 1.x and earlier: The pull behavior is determined by the runtime's internal logic.

    ignore_image_defined_volumes

    Specifies whether to ignore anonymous volumes defined in an image with the VOLUME instruction. Set to true to prevent containers from automatically creating anonymous volumes.

    Bool

    Default value: true

    limitCore

    The maximum size in bytes of a core file that can be generated when a containerized process core dumps.

    Key values:

    • 0: Disables the generation of core dump files.

    • infinity: No size limit.

    Int

    • Valid range: A non-negative integer

    • Default value: infinity

    limitNoFile

    The maximum number of file descriptors that can be opened within a container.

    Int

    • Valid range: ≥ 1024

    • Default value: 1048576

    limitMemLock

    The maximum amount of memory in bytes that a process in a container can lock.

    Int

    • Valid range: ≥ 65536

    • Default value: Typically 65536, consistent with the host OS.

      For Lingjun nodes or nodes where RDMA or EDMA devices are detected during initialization, the default is automatically set to infinity. This behavior is not triggered if devices are attached after the node is ready.

    Registry Mirror Configuration

    Description

    Recommendation

    Configure registry mirrors for an image registry so the container runtime can pull images from alternative registries to accelerate image pulls.

    Each registry mirror supports custom path mapping through override_path.

    This change does not require restarting containers.

    • Use a local image registry to accelerate image pulls.

    • Configure multiple registry mirrors for high availability and fault tolerance.

    Image Registries Skipping Certificate Authentication (Insecure Registries)

    Description

    Recommendation

    Allows the container runtime to skip certificate validation for specified image registries when pulling images. This setting is intended for test environments to pull images from registries that use self-signed certificates.

    This change does not require restarting containers.

    • Skipping certificate validation poses security risks. Use this option only in development and testing environments.

    • Configure this parameter only for a private registry that uses a self-signed certificate or cannot obtain a valid certificate.

    Procedure

    Modifying containerd configurations does not affect existing containers. To ensure cluster stability, perform this operation during off-peak hours.

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Nodes > Node Pools.

    3. On the Node Pools page, find the desired node pool, and in its Actions column, choose image > Containerd Configuration.

    4. Read the precautions, follow the on-screen instructions to add parameters, specify target nodes, and set the batch policy, then click Submit.

      See Configuration examples below.

      • If you remove the custom container runtime configuration, it automatically reverts to the default value.

      • After you submit, the settings are applied to nodes in batches, which takes time. You can monitor progress and manage the update in the Event Records area, such as pausing, resuming, or canceling it. If a node update fails, troubleshoot the issue and click Continue to retry.

        Pausing the update allows you to validate changes on already-updated nodes. When paused, nodes currently being updated will finish, but new updates are postponed until you resume the task. We recommend that you complete the configuration task as soon as possible. Paused tasks are automatically canceled after seven days, deleting all related records and logs.

    Configuration examples

    Mirror for docker.io

    Insecure private registry

    HTTP private registry

    In the Registry mirrors section, enter docker.io for Image registry, enter the mirror address (for example, https://example.com) for Registry mirror, and select false for override_path.

    In the Insecure registries section, enter the private registry address in the Image registry field, in the format IP address:Port (for example, 192.xxx.xxx.xxx:443), and set skip_verify to true to skip certificate validation.

    In the Registry mirrors section, enter the private registry address (for example, 192.xxx.1) for Image registry, enter the corresponding HTTP address (for example, http://192.xxx.1) for Registry mirror, and select false for override_path. You can click + Add to add more registry mirror mappings.

    FAQ

    Do custom containerd settings affect running services?

    No. The changes do not affect running Pods and apply only to Pods created after the update. We recommend that you perform this operation during off-peak hours.

    To apply the new settings to existing Pods, you must manually recreate them.

    Error with not match XXX or must be between XXX errors

    This error usually occurs for the following reasons:

    • must be between XXX: The value you entered is invalid. Verify that the value is formatted correctly and is within the allowed range.

    • not match XXX: You used an unsupported modification method. ACK blocks direct modifications made to the configuration file from the command line. Revert the parameter to its original value in the file.

    Related topics